fix(deps): update module golang.org/x/image to v0.41.0 [security] (#37904)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [golang.org/x/image](https://pkg.go.dev/golang.org/x/image) |
[`v0.40.0` →
`v0.41.0`](https://cs.opensource.google/go/x/image/+/refs/tags/v0.40.0...refs/tags/v0.41.0)
|
![age](https://developer.mend.io/api/mc/badges/age/go/golang.org%2fx%2fimage/v0.41.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/golang.org%2fx%2fimage/v0.40.0/v0.41.0?slim=true)
|

---

### Panic when reading out of bound palette index in
golang.org/x/image/bmp
[CVE-2026-42500](https://nvd.nist.gov/vuln/detail/CVE-2026-42500) /
[GO-2026-5031](https://pkg.go.dev/vuln/GO-2026-5031)

<details>
<summary>More information</summary>

#### Details
Decoding a paletted BMP file with an out-of-range palette index results
in a panic when accessing pixels in the invalid image.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79576](https://go.dev/issue/79576)
-
[https://groups.google.com/g/golang-announce/c/uhYX90BlBvI](https://groups.google.com/g/golang-announce/c/uhYX90BlBvI)
- [https://go.dev/cl/781500](https://go.dev/cl/781500)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5031) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Excessive resource consumption in PackBits decompression in
golang.org/x/image/tiff
[CVE-2026-46599](https://nvd.nist.gov/vuln/detail/CVE-2026-46599) /
[GO-2026-5032](https://pkg.go.dev/vuln/GO-2026-5032)

<details>
<summary>More information</summary>

#### Details
The TIFF decoder does not place a limit on the size of
PackBits-compressed data. A maliciously-crafted image can exploit this
to cause a small image (both in terms of pixel width/height and encoded
size) to make the decoder decode large amounts of compressed data.

#### Severity
Unknown

#### References
- [https://go.dev/issue/79577](https://go.dev/issue/79577)
- [https://go.dev/cl/759960](https://go.dev/cl/759960)
-
[https://groups.google.com/g/golang-announce/c/uhYX90BlBvI](https://groups.google.com/g/golang-announce/c/uhYX90BlBvI)

This data is provided by
[OSV](https://osv.dev/vulnerability/GO-2026-5032) and the [Go
Vulnerability Database](https://redirect.github.com/golang/vulndb)
([CC-BY 4.0](https://redirect.github.com/golang/vulndb#license)).
</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNDEuNSIsInVwZGF0ZWRJblZlciI6IjQzLjE0MS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->