chore: bump distribution/v3 to 3.1.1 and go-redis to 9.7.3

[stirby]

Bumps distribution/distribution/v3 from v3.0.0-alpha.1 to 3.1.1 and redis/go-redis/v9 to 9.7.3. govulncheck: 75 reachable to 56, fixing 19.

envbuilder embeds distribution as the local registry in serveLocalRegistry, which is used for cache probing, so these are linked into the binary. The Redis cache advisories only apply when the Redis descriptor cache is configured, and envbuilder does not configure it.

Other changes:

• distribution 3.1 pulls otlploggrpc 0.18.0, which has GO-2026-6508. Bumped the otel log exporters (otlploggrpc, otlploghttp, stdoutlog) to v0.21.0 together, because mixed versions do not compile.
• Moving off an alpha tag to a stable release. Please check that the embedded registry config in serveLocalRegistry still behaves the same. CI's TestPushImage and cache-probe integration tests cover this.

Part of a set of independent dependency PRs. All touch go.mod/go.sum, so rebase with go mod tidy after the first one merges.

Generated by Coder Agents on behalf of @stirby.