Pinning VS Code Extensions to Fight Supply Chain Attacks

Pin VS Code extension versions in dev containers to prevent supply chain attacks. Treat extension updates like dependency upgrades -- deliberate and reviewed.