build: pin to distroless image tagged latest (#2509)

The UX of the UI for
[gcr.io/distroless/base](https://gcr.io/distroless/base) is weird.
Apparently the latest image is the one tagged with `latest`, which has
an update time older than the image reported as most recently updated.

Are you confused? I'm confused.

docker/indexer/Dockerfile

@@ -24,7 +24,7 @@ RUN go mod download
 COPY ./ /build
 RUN CGO_ENABLED=0 ./build.sh
 
-FROM gcr.io/distroless/base@sha256:5c395fa86ad4eb0613bc9cae7412003f575a25ff9b5cb4845e37e175d2a50bba
+FROM gcr.io/distroless/base-debian12@sha256:1aae189e3baecbb4044c648d356ddb75025b2ba8d14cdc9c2a19ba784c90bfb9
 COPY --from=GO_BUILD build/indexer /indexer
 ENTRYPOINT ["/indexer"]
 CMD ["--help"]