feat(builder): pin buildpacks to a commit SHA

This PR pins buildpacks to a known version. This allows us to control
what commit of the buildpack that we wish to install at build-time,
rather than relying on master to work.

fixes #3