[ci] Pin master in Cirrus (#4667)

This uses a pinned version from a file instead of `master` when checking out Flutter for `master` channel testing in Cirrus. Currently it's a static version, but this will be updated by an auto-roller.

This uses a version of `master` from several days ago to avoid the current tree breakage due to flutter/flutter#96661

This will not affect LUCI tests; that will require a separate recipe change.

Part of flutter/flutter#93811

.ci/flutter_master.version

@@ -0,0 +1 @@
+3e6e996f9eff50d77214d37c1c5f8b71bcc0d559

.cirrus.yml

@@ -15,15 +15,25 @@ tool_setup_template: &TOOL_SETUP_TEMPLATE
 
 flutter_upgrade_template: &FLUTTER_UPGRADE_TEMPLATE
   upgrade_flutter_script:
+    # Master uses a pinned, auto-rolled version to prevent out-of-band CI
+    # failures due to changes in Flutter.
+    # TODO(stuartmorgan): Investigate an autoroller for stable as well.
+    - TARGET_TREEISH=$CHANNEL
+    - if [[ "$CHANNEL" == "master" ]]; then
+    -   TARGET_TREEISH=$(< .ci/flutter_$CHANNEL.version)
+    - fi
     # Ensure that the repository has all the branches.
     - cd $FLUTTER_HOME
     - git config remote.origin.fetch "+refs/heads/*:refs/remotes/origin/*"
     - git fetch origin
-    # Switch to the requested branch.
-    - git checkout $CHANNEL
-    # Reset to upstream branch, rather than using pull, since the base image
-    # can sometimes be in a state where it has diverged from upstream (!).
-    - git reset --hard @{u}
+    # Switch to the requested channel.
+    - git checkout $TARGET_TREEISH
+    # When using a branch rather than a hash, reset to the upstream branch
+    # rather than using pull, since the base image can sometimes be in a state
+    # where it has diverged from upstream (!).
+    - if [[ "$TARGET_TREEISH" == "$CHANNEL" ]]; then
+    -   git reset --hard @{u}
+    - fi
     # Run doctor to allow auditing of what version of Flutter the run is using.
     - flutter doctor -v
   << : *TOOL_SETUP_TEMPLATE