fix: derive third-party notices base image from Dockerfile

[git-jxj]

The notices generator hardcodes distroless Go v4.0.2 even though the runtime Dockerfile now uses v4.1.1. Regenerating the notices therefore preserves the stale image name and source-index URL.

Read the image from the Dockerfile's final FROM and derive both fields from its version tag. Tagged digest references preserve the full image reference while using the tag for the source index. Unsupported references fail with an explicit error instead of producing incorrect notices. Regenerate THIRD_PARTY_NOTICES.md; only those two fields change.

Fixes #210.

Validation:

• Ran the original generator for both configured architectures and reproduced the mismatch in its output.
• make notices and make notices-check.
• Ran the full generator against a Dockerfile fixture with multiple stages, a changed version, and a digest; confirmed both generated fields follow the final runtime image.
• bash -n tools/generate-notices.sh, shellcheck -e SC2016 tools/generate-notices.sh (Markdown backticks in single-quoted strings are intentional), and parser cases covering unsupported references.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[git-jxj]

The current head 48f1890996a7 still has no CI checks, and the copy-pr bot reports that NVIDIA runner validation requires a PR vetter. Could a maintainer vet and authorize this head through the repository's /ok to test process so the workflows can run?