Ship Python 3.8.7
For 0.19 (currently building rc1 while filing this), this is a no-brainer: we should update the 'default' CI images, and we'll have enough build occuring naturally until 0.19.0 to be comfortable.
For 0.18.1, we should probably first bump the various 'stable' CI images to 3.8.7 first, then make sure to run the appropriate pipelines.