Pin kustomize image in cockroachdb example

- Pin to v5.4.1 with sha256 as example of how to ensure supply-chain
  security. Pulling the latest kustomize image or source is insecure
  without checksum validation.
- Bump example image tag to v0.1.1

functions/examples/template-heredoc-cockroachdb/image/Dockerfile

@@ -1,12 +1,10 @@
 # Copyright 2019 The Kubernetes Authors.
 # SPDX-License-Identifier: Apache-2.0
 
-FROM golang:1.21-bullseye
-ENV CGO_ENABLED=0
-RUN go get -v sigs.k8s.io/kustomize/kustomize
+ARG KUSTOMIZE_IMAGE_TAG
+ARG KUSTOMIZE_IMAGE_SHA
 
-FROM alpine:latest
+FROM registry.k8s.io/kustomize/kustomize:${KUSTOMIZE_IMAGE_TAG}@${KUSTOMIZE_IMAGE_SHA}
 RUN apk add --no-cache bash
-COPY --from=0 /go/bin/kustomize /usr/local/bin
 COPY cockroachdb-template.sh /usr/local/bin/config-function
 CMD ["config-function"]