[ci] Consider consistent Drake version pinning and/or canary builds

[EricCousineau-TRI]

At present, CMake can use latest nightly binaries, whereas Bazel is currently pinned.

Possible options for consistency:

• Use pinning for both CMake and Bazel. Make an explicit optional "canary" set of builds so that we can preview breakages as they come in.
  • This is similar to what we do in Anzu - explicit updates to Drake, but with canary integration CI to test Anzu master against Drake master.
  • Ideally, this setup should be applied to rolling builds too.
• Make both CMake and Bazel "bleeding edge" and require fixes, a la `drake-external-examples.

See @sloretz's additional notes here:
#242 (review)

[jwnimmer-tri]

My 2c:

As much as possible, for GitHub actions use a pre-compiled Drake. I guess the actions don't have a lot of cores, so it takes a long time to get everything built. Plausibly, it would be best to pin to latest stable (tagged) Drake for this case. Steady-state, I don't think that drake-ros should depend on bleeding-edge Drake (unless a user opts-in to that).

For a canary build / integration test, I can offer our https://drake-jenkins.csail.mit.edu/ service so that we're using Drake-funded machines that are fast enough to rebuild the whole world from scratch. It could do a nightly build to cross-check that the most recent drake and drake-ros sources play well together.