Pin lab versions in latest, testing, and future images

[leighmcculloch]

The lab version is currently set as main in the latest, testing, and future images.

It should be pinned to a specific version, so that images being rebuilt produce a predictable build with a predictable set of features.

If lab is broken on main temporarily, we won't end up with a broken lab in some images of quickstart.

[leighmcculloch]

I understand lab doesn't have proper release process, every commit is released. I think we can write a GH Action that runs fortnightly or monthly to update the sha to the latest, so it stays up to date, with minimal intervention on a normal basis.

[leighmcculloch]

The main problem with this today is that without pinning lab the version of lab in latest, testing, and future can be different for a single build. Addressing that in:

• Refactor build pipeline to reduce duplicate builds #778

And after that merges will close this as sufficient since the worse problem by using a branch for lab's ref is fixed.