fix: Correctly set ARG and revert docker hash back to original version

[another-rex]

Turns out, ARG only applies to the current FROM section, so all of the ARGs in our test docker files were placebo and didn't do anything. The variable was just empty and just installed whatever version npm felt like haha, this meant recently the image building broke as npm started trying to install a newer version of itself that's not compatible with the version of node this image is pinned to. E.g. https://github.com/google/osv-scanner/actions/runs/12821471894/job/35752742949?pr=1505

Also revert the change where I updated the sha, now keeps using the existing older sha for more results.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.06%. Comparing base (a6d4ec8) to head (6c793bf).
Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1508   +/-   ##
=======================================
  Coverage   67.06%   67.06%           
=======================================
  Files         200      200           
  Lines       18953    18953           
=======================================
  Hits        12711    12711           
  Misses       5553     5553           
  Partials      689      689           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[G-Rath]

Well, whoops