fix(gvisor): switch update-hashes and downloads to GitHub release tarballs

[mehrdadbn9]

What type of PR is this?

/kind bug

What this PR does / why we need it

gVisor changed its release artifacts (google/gvisor#13718): the per-arch binary .sha512 files under storage.googleapis.com/gvisor/releases/release/{version}/{arch}/ no longer exist for new releases, so the update-hashes script fails with HTTP 404 and new gVisor versions cannot be added. Verified live: all .sha512 URLs return 404 for 20260824.0 (newest tag), while 20260817.0 still resolves — the breakage is silent today and hard-blocks the next bump.

Since release-20260817.0, gVisor publishes GitHub releases containing gvisor-{arch}.tar.bz2 archives plus SHA256SUMS and SHA512SUMS files.

Changes:

• replace the gvisor_runsc_binary / gvisor_containerd_shim_binary entries in component_hash_update with a single gvisor_archive entry pointing at the GitHub release SHA512SUMS file, with an extractor mapping the two tarball hashes to x86_64 / aarch64
• collapse the two download definitions (gvisor_runsc, gvisor_containerd_shim) into one gvisor_archive download with unarchive: true
• copy runsc and containerd-shim-runsc-v1 from the extracted gvisor/ directory in the gvisor role
• add gvisor_archive_checksums for 20260817.0 (amd64/arm64); old per-arch checksum variables remain as aliases so existing data keeps resolving

Which issue(s) this PR fixes

Fixes #13460

Special notes for your reviewer

• The GitHub release asset for SHA512SUMS is fetched from github.com/google/gvisor/releases/download/release-{version}/SHA512SUMS; releases only exist from 20260817.0 onward, so older versions keep the legacy data in checksums.yml untouched.
• _get_hash_by_arch formats the URL with os=linux but the new URL only uses version, which is fine (extra kwargs ignored by .format).
• Verified locally that the update-hashes script runs end-to-end for the new component and rewrites checksums.yml without error (GraphQL rate-limit logs shown below).

Does your PR introduce a user-facing change?

Update gVisor downloads to the new GitHub release tarball artifacts and fix the update-hashes script for new gVisor versions.

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mehrdadbn9
Once this PR has been reviewed and has the lgtm label, please assign tico88612 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubernetes-prow]

Hi @mehrdadbn9. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.