build: pin envoy-build-ubuntu to upstream v1.38.2 image

The build stage compiles envoy from source via do_ci.sh inside the
envoy-build-ubuntu toolchain image, so it must match the build image
upstream uses for the release we ship (v1.38.2).

The Dockerfile pinned tag f4a881a1 (digest b10346fe), which does not
correspond to any 1.38.x release. Upstream v1.38.0/1/2 all use build
tag 86873047 (per .github/config.yml build-image.tag). Repin to that
tag and its multi-arch digest 1b3c82ca so we build with the correct
toolchain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cybercyst

Dockerfile

@@ -1,5 +1,5 @@
 # STAGE: build
-FROM envoyproxy/envoy-build-ubuntu:f4a881a1205e8e6db1a57162faf3df7aed88eae8@sha256:b10346fe2eee41733dbab0e02322c47a538bf3938d093a5daebad9699860b814 AS build
+FROM envoyproxy/envoy-build-ubuntu:86873047235e9b8232df989a5999b9bebf9db69c@sha256:1b3c82ca34c505c4951918b2e0a0c3db88cf266ebbf4196e4b0fba8fa137ada3 AS build
 WORKDIR /source
 # COPY /home/cybercyst/.cache/envoy-bazel /root/.cache/envoy-bazel
 COPY . .