fix: pin Debian cloud image version

We were using 'latest', which would cause the integrity to change (and
the build to break, on a machine without cache) every time a new version
was released upstream. Also, we probably should use a consistent version
for reproducibility, anyway.