chore(deps): pin dependencies

Signed-off-by: Renovate Bot <renovate-bot@users.noreply.github.com>

Author: renovate[bot]

gcb/makestage/cloudbuild.yaml

@@ -25,7 +25,7 @@ timeout: 2700s # 45m
 steps:
 # cert-manager relies on the git checkout to determine release version, among other things
 # By default, gcb only does a shallow clone, so we need to "unshallow" to get more details
-- name: gcr.io/cloud-builders/git
+- name: gcr.io/cloud-builders/git@sha256:f7e282ab9457a47c6b4f980d031baf248b05cc622d285f4b7c10802047f6b3bf
   dir: "go/src/github.com/cert-manager/cert-manager"
   entrypoint: bash
   args:

pkg/release/helm/testdata/cert-manager/values.yaml

@@ -8,7 +8,7 @@ image:
   repository: nginx
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: ""
+  tag: "@sha256:fb01117203ff38c2f9af91db1a7409459182a37c87cced5cb442d1d8fcc66d19"
 
 imagePullSecrets: []
 nameOverride: ""