pin buildpacks to known tags

Signed-off-by: Matthew Fisher <matthewf@opdemand.com>