[docker] update docker files to pin to debian stretch

Previously we used debian:stable (which breaks pinned apt-get calls
when stable is updated)

Change-Id: I98504f396c9774315759fd69ff27ad93e42d3cea
diff --git a/kubernetes/cobalt_common/Dockerfile b/kubernetes/cobalt_common/Dockerfile
index d4a137e..70a3d89 100644
--- a/kubernetes/cobalt_common/Dockerfile
+++ b/kubernetes/cobalt_common/Dockerfile
@@ -14,7 +14,7 @@
 
 # Base cobalt image.  It's a Debian system with a couple of extra bits.
 
-FROM debian:stable
+FROM debian:stretch
 
 COPY libunwind.so.1 /usr/lib/
 COPY libc++.so.1 /usr/lib/
diff --git a/kubernetes/report_master/Dockerfile b/kubernetes/report_master/Dockerfile
index 8cf1709..92d196c 100644
--- a/kubernetes/report_master/Dockerfile
+++ b/kubernetes/report_master/Dockerfile
@@ -17,7 +17,7 @@
 # If this fails, look for troubleshooting information in the instructions
 # for executing cobaltb.py deploy build.
 RUN apt-get update
-RUN apt-get install -y git=1:2.11.0-3+deb9u2
+RUN apt-get install -y git=1:2.11.0-3+deb9u3
 
 COPY analyzer_report_master /usr/local/bin/