Reference Docker Hub image by SHA

Download the Docker Hub container image by its SHA, so that we know
exactly which version of the Asciidoctor tools we use to buid the spec.
The version (SHA) should be updated periodically as new container
images are published.

.github/workflows/CI.yml

@@ -25,8 +25,11 @@ jobs:
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
 
-    # Use Khronos container with asciidoctor toolchain preinstalled
-    container: khronosgroup/docker-images:asciidoctor-spec
+    # Use the Khronos container with the asciidoctor toolchain preinstalled.  We
+    # reference the image by its SHA rather than its tag because they sometimes
+    # overwrite a tag with a different image (which has a different SHA).  This
+    # corresponds to tag 20240627.
+    container: khronosgroup/docker-images:asciidoctor-spec@sha256:91a1b62399f9804e17110e89d85d62e90bc8d2ad7b94a329bee87784158368a9
 
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it