chore(ci): update distroless base to Debian 13 (release-5.8) (#7993)

## Summary
- Update distroless base from Debian 12 to Debian 13 (eliminates glibc
CVE-2026-0861)

No workflow, FIPS, or goreleaser changes. Minimal patch for release-5.8.

Supersedes #7992 (closed due to force-push cleanup).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: buger

ci/Dockerfile.distroless

@@ -1,5 +1,7 @@
 # Generated by: gromit policy
 
+ARG BASE_IMAGE=gcr.io/distroless/base-debian13:nonroot
+
 FROM debian:trixie-slim AS deb
 ARG TARGETARCH
 ARG BUILD_PACKAGE_NAME
@@ -10,7 +12,7 @@ ENV DEBIAN_FRONTEND=noninteractive
 COPY ${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb /
 RUN dpkg -i /${BUILD_PACKAGE_NAME}_*${TARGETARCH}.deb && rm /*.deb
 
-FROM gcr.io/distroless/base-debian12:latest
+FROM ${BASE_IMAGE}
 
 COPY --from=deb /opt/tyk-gateway /opt/tyk-gateway