Bump TF and fix protobuf dep in samples Docker image. (#9241)

Similar to https://github.com/google/iree/pull/9236
diff --git a/build_tools/buildkite/samples.yml b/build_tools/buildkite/samples.yml
index 58f6daa..31e0c27 100644
--- a/build_tools/buildkite/samples.yml
+++ b/build_tools/buildkite/samples.yml
@@ -7,7 +7,7 @@
 steps:
   - label: "Test Colab notebooks"
     commands:
-      - "docker run --user=$(id -u):$(id -g) --volume=\\$PWD:\\$IREE_DOCKER_WORKDIR --workdir=\\$IREE_DOCKER_WORKDIR --rm gcr.io/iree-oss/samples@sha256:2ee255805160dcd04a851c53a3cf6275c616e47b6fe74a025d3115d5e6ab180e python3 ./samples/colab/test_notebooks.py"
+      - "docker run --user=$(id -u):$(id -g) --volume=\\$PWD:\\$IREE_DOCKER_WORKDIR --workdir=\\$IREE_DOCKER_WORKDIR --rm gcr.io/iree-oss/samples@sha256:410a02ea7d0f9941f3856365dfd6b58981dfed89c9f6df1cab1b51c7ae476403 python3 ./samples/colab/test_notebooks.py"
     env:
       IREE_DOCKER_WORKDIR: "/usr/src/github/iree"
     agents:
@@ -15,7 +15,7 @@
 
   - label: "Test Samples"
     commands:
-      - "docker run --user=$(id -u):$(id -g) --volume=\\$PWD:\\$IREE_DOCKER_WORKDIR --workdir=\\$IREE_DOCKER_WORKDIR --rm gcr.io/iree-oss/samples@sha256:2ee255805160dcd04a851c53a3cf6275c616e47b6fe74a025d3115d5e6ab180e ./build_tools/testing/test_samples.sh"
+      - "docker run --user=$(id -u):$(id -g) --volume=\\$PWD:\\$IREE_DOCKER_WORKDIR --workdir=\\$IREE_DOCKER_WORKDIR --rm gcr.io/iree-oss/samples@sha256:410a02ea7d0f9941f3856365dfd6b58981dfed89c9f6df1cab1b51c7ae476403 ./build_tools/testing/test_samples.sh"
     env:
       IREE_DOCKER_WORKDIR: "/usr/src/github/iree"
     agents:
diff --git a/build_tools/docker/prod_digests.txt b/build_tools/docker/prod_digests.txt
index 69b1e7a..1db3538b 100644
--- a/build_tools/docker/prod_digests.txt
+++ b/build_tools/docker/prod_digests.txt
@@ -1,6 +1,6 @@
 gcr.io/iree-oss/base@sha256:32a501b23abeae69eb33e5e78295312f5df28bacabc799dffe218764a66ed28e
 gcr.io/iree-oss/swiftshader@sha256:d27bd8ffdffa7abcd02970408b2665b2a7b1e8238e5b3561672633bd3e52652e
-gcr.io/iree-oss/samples@sha256:2ee255805160dcd04a851c53a3cf6275c616e47b6fe74a025d3115d5e6ab180e
+gcr.io/iree-oss/samples@sha256:410a02ea7d0f9941f3856365dfd6b58981dfed89c9f6df1cab1b51c7ae476403
 gcr.io/iree-oss/frontends@sha256:2f4218945317664c5a9bf636c335ec5248b0842c47c922ed9a6d981a3146b9da
 gcr.io/iree-oss/frontends-nvidia@sha256:d00c96dab0d789f890a827fd19de1a74d0ee1f40092e8979c217a732e99b1feb
 gcr.io/iree-oss/frontends-swiftshader@sha256:d44a1f49cbe6672e87a82612160c70b59c3ef3d6d1d0ef4b621d4436ee329d3e
diff --git a/build_tools/docker/samples/Dockerfile b/build_tools/docker/samples/Dockerfile
index 72d72aa..ade5f49 100644
--- a/build_tools/docker/samples/Dockerfile
+++ b/build_tools/docker/samples/Dockerfile
@@ -26,5 +26,16 @@
     numpy \
     matplotlib \
     bottleneck \
-    tensorflow==2.5.0 \
+    tensorflow==2.8.0 \
     tensorflow_hub==0.12.0
+
+# NOTE: 2022-05-27: protobuf 4.21.0, released on May 25, 2022 is incompatible
+# with prior releases. Specifically implicated are the above versions of
+# tensorflow, which seem to include it without a version pin and therefore
+# break out of the box. The next time the above versions are upgraded,
+# try removing this line and then, within the docker image, run:
+#   python3 -c "import tensorflow"
+# If that fails with a stack trace, put this line back.
+# On behalf of Google, we are sorry for the live at head philosophy
+# and shoddy version management leaking into everything. We're victims too.
+RUN python3 -m pip install protobuf==3.20.1 --force-reinstall