ci/builder: pin to known good version of AWS CLI

[benesch]

The latest version (v2.17.2) has a weird glitch that causes the website deploy job to occasionally fail to find EC2 instance role credentials. Downgrade to an older version of the AWS CLI that was working properly. Pinning the version in the CI builder is also just a healthy thing to do, so this doesn't change on us unexpectedly the next time we have to rebuild the CI builder image.

Motivation

• This PR fixes a bug reported on Slack.

Checklist

• This PR has adequate test coverage / QA involvement has been duly considered. (trigger-ci for additional test/nightly runs)
• This PR has an associated up-to-date design doc, is a design doc (template), or is sufficiently small to not require a design.
• If this PR evolves an existing $T ⇔ Proto$T mapping (possibly in a backwards-incompatible way), then it is tagged with a T-proto label.
• If this PR will require changes to cloud orchestration or tests, there is a companion cloud PR to account for those changes that is tagged with the release-blocker label (example).
• This PR includes the following user-facing behavior changes:
  • n/a