Update pinned CI image
As usual, we pin one job to a known-working image in case the automatically built images have a defect.
Also adapts the headers to the new version of IWYU that the newly built image brought in. (Otherwise we'll get gradual failures every time those files get touched.)