Update CI image for staging-with-rebase tests

[conorsch]

Description

The cloud image used to run the staging-with-rebase test suite in CircleCI was last built about a year ago:

$ gcloud --project securedrop-ci compute images list --filter="family:fpf-securedrop AND name ~ ^ci-nested-virt-stretch" --format json | grep -i creationtimestamp
    "creationTimestamp": "2019-05-15T20:10:18.310-07:00",
    "creationTimestamp": "2019-07-25T09:47:57.609-07:00",

Since we bake in the Xenial vagrant images into the image to avoid pulling them, that means the apt lists inside those vagrant images were also last updates about a year ago. Since the CI run includes an apt-upgrade, let's rebuild the boxes to minimize CI run time.

Since we're heading into QA for 1.4.0, I propose we don't change CI until after the release. It's worth noting that the CI image selection logic will always choose the newest—I propose we start pinning a hardcoded version to make the results a bit more predictable.

We should also update the base image stretch -> buster, in line with the dev docs.

[conorsch]

For reference, the CI run in https://app.circleci.com/pipelines/github/freedomofpress/securedrop/429/workflows/6cfea059-0390-4e7d-91f4-e75c7e35016a/jobs/41781/steps took 49m 20s on the staging-with-rebase step.

[conorsch]

Another reference: https://app.circleci.com/pipelines/github/freedomofpress/securedrop/432/workflows/6bfb0e98-0682-4c7b-adfd-3e7c7ba455bb/jobs/41825/steps shows 48m 2s.

[conorsch]

Seeing run times of the staging-test-with-rebase job that are ~10m shorter in #5360. That's a nice benefit, but the major change is that we're now testing on Buster, rather than Stretch, matching the dev docs. Whether the change also reduces error rate for the job remains to be seen.