Lock versions in CNG images
Now that we have all our images built, we should lock down all the libraries versions to avoid surprises.
For example, both the runtime and builtime deps are unlocked which means we can get a surprise every time we build a new image.
/cc @twk3 @WarheadsSE