fix(nvca): bump grpc and distroless/go base image to remediate container OSS vuln SLA failures on v3.7

[apartha-nv]

Summary

Cherry-pick of #2161 (merged to main as 4a49a38) onto the v3.7 release line, following the same pattern as the v3.2 backport (#2118, #2129).

• Bumps google.golang.org/grpc v1.79.3 -> v1.83.1, remediating:
  • GO-2026-6348: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
  • GO-2026-6061: xDS RBAC authorization engine and HTTP/2 transport server vulnerabilities
• Bumps the shared distroless_go base image pin v4.1.2 -> v4.1.4.
• Includes the CI fix for the generated dependency docs workflow (SIGPIPE from the scope script's early exit on a large diff).

Verification

• bazel build //src/compute-plane-services/nvca/cmd/{nvca,nvca-operator,cluster-validator} succeeds cleanly on this branch (verified locally).
• Cherry-pick applied with zero conflicts.

Related: #2161

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: NVIDIA/nvcf/.coderabbit.yaml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 300d2812-8f27-4aa6-9993-f1f58888d806

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}