Run clippy checks against a specific version

[jsha]

Right now, we run clippy checks against the latest stable, which means we get spurious build failures when new stable versions are released.

We should use a specific Rust version in our regular CI, and optionally have an additional cron-based CI that builds with stable, which will alert us when there are new clippy lints because there's a new stable.