Pin dockerfile dependencies by hash

**If you are reporting *any* crash or *any* potential security issue, *do not*
open an issue in this repo. Please report the issue via emailing
envoy-security@googlegroups.com where the issue will be triaged appropriately.**

*Title*: *Reduce attack surface by pinning docker dependencies by hash*

*Description*:
[scorecard](github.com/ossf/scorecard) reports
```
!! frozen-deps - .devcontainer/Dockerfile has non-pinned dependency 'gcr.io/envoy-ci/envoy-build:55d9e4719d2bd0accce8f829b44dab70cd42112a'
!! frozen-deps - ci/Dockerfile-envoy-alpine has non-pinned dependency 'frolvlad/alpine-glibc:alpine-3.12_glibc-2.31'
!! frozen-deps - ci/Dockerfile-envoy-distroless has non-pinned dependency 'gcr.io/distroless/base-debian10:nonroot'

```

*Fix*:
Pin dependencies by hash. Example [here](https://github.com/ossf/scorecard/blob/main/Dockerfile).
You can retrieve the digest corresponding to the dependencies thru:
```
$ docker pull
...
Digest: sha256:acf7795dc91df17e10effee064bd229580a9c34213b4dba578d64768af5d8c51
...
```