[Misc] Update base Docker image and lock version

[madsboddum]

The current Dockerfile starts like this:

FROM debian:stretch-slim
...

debian:stretch-slim is being updated outside of our control, meaning our builds can change without us really knowing about it.
It would be better to select a tag that never changes after being published, such as stretch-20220622-slim.

While we're at it, updating to a newer version would be good.

Maybe configure Dependabot to do this automatically in the future.

To ensure it works and keeps working, create an automated test that starts a Docker container using the Dockerfile.
There are other benefits to doing this, as we generally can trust changesets more.