Pin system packages

[jsf9k]

💡 Summary

We should pin the versions of the system packages we install to facilitate reproducible builds.

Motivation and context

Reproducible builds are key for our cisagov/skeleton-docker descendants.