Build: pin dependencies by hash

Description

Currently, the dependencies such as containerd and runc are not pinned by the hash:

https://github.com/moby/moby/blob/a1836eb2834010c69cbf6de80095508f084fa6b4/hack/dockerfile/install/containerd.installer#L13-L19

These dependencies are also consumed by docker-ce-packaging here: https://github.com/docker/docker-ce-packaging/blob/7e726fa319c261676d06b6ae10c04a3df80e4c48/static/Makefile#L43-L58

Tasks:

• Integrate rego to buildx https://github.com/docker/buildx/pull/3539
• Update Dockerfile to replace RUN git clone <GITURL> to ADD <GITURL> https://github.com/moby/moby/pull/51638
• Replace go install @TAG to use ADD <GITURL> https://github.com/moby/moby/pull/51638
• Switch away from https://github.com/moby/moby/tree/a1836eb2834010c69cbf6de80095508f084fa6b4/hack/dockerfile/install to ADD <GITHRL> https://github.com/moby/moby/pull/51640 (Reverted: https://github.com/moby/moby/pull/51733)
• Switch away from https://github.com/moby/moby/blob/a1836eb2834010c69cbf6de80095508f084fa6b4/hack/dockerfile/cli.sh to ADD <GITURL>, or maybe COPY --from=docker:VERSION /usr/local/bin/docker https://github.com/moby/moby/pull/51639
• Create Dockerfile.rego (examples: https://github.com/tonistiigi/buildx-rego-examples) to pin the dependencies

Previous attempts:

• https://github.com/moby/moby/pull/49674
• https://github.com/moby/moby/pull/51626

Start by reviewing hack/dockerfile/install and hack/dockerfile/cli.sh, along with the linked Dockerfile and packaging Makefile references. Compare the completed buildx and Dockerfile changes with the reverted pull request and previous attempts before choosing the remaining approach. Done means the remaining dependencies are pinned by hash through Dockerfile.rego or the specified ADD/COPY changes.