Update docker file to include go digest along with go version.

`GO_VERSION` is used as a build-arg in the release workflow (it passes only the version extracted from go.mod). That overrides this default `tag@digest` value, so CI/release builds will end up using an unpinned `golang:1.25.9` base and the digest pinning here won’t actually take effect for published images. Consider either (a) passing `tag@digest` from the workflow, (b) splitting version and digest into separate args (or hardcoding digest in `FROM`), or (c) removing the workflow override if you want Dockerfile-controlled pinning.
```suggestion
ARG GO_VERSION=1.25.9
ARG GO_IMAGE_DIGEST=sha256:7a00384194cf2cb68924bbb918d675f1517357433c8541bac0ab2f929b9d5447
FROM golang:${GO_VERSION}@${GO_IMAGE_DIGEST} AS build
```

ref: https://github.com/Kong/deck/pull/1997#discussion_r3064194735

Start by tracing the GO_VERSION build argument from the release workflow into the Dockerfile, then compare it with the version in go.mod and the suggested digest-pinned FROM line. Confirm that release builds use a pinned golang base image, while preserving the intended version behavior.

Written by the indexing model from the issue text.