chore(release): re-cut v1.25.19 on UBI 9.8

What does this MR do and why?

Moves the three Dockerfiles' base images from UBI 9.5 to UBI 9.8, using the build tags Renovate proposed, and updates the strings that describe the base: the site diagram, the hadolint example, the unused UBI_VERSION constant, and the FIPS smoke fixture. The 9.5 layer dated from 2025-05-13, and its scan of the FIPS debug image carried 30 High findings, 24 of them fixed in 9.8 packages. CHANGELOG records that v1.25.19 is re-tagged on UBI 9.8 before any announcement.

References

• Renovate's update for the same pins, which received no pipeline and is superseded here: !28 (closed)
• Trivy report on the 9.5 base: the container_scanning job in https://gitlab.com/gitlab-com/public-sector/kaniko/-/pipelines/2820303594

Variants affected

All six.

Test plan

• glab ci lint .gitlab-ci.yml: valid.
• The MR pipeline builds, signs, attests, and verifies all six variants and runs both FIPS smoke jobs against the new base.
• Container scanning of -fips-debug should report fewer than 30 High findings.