fix(security): patch gpgv/libssl3t64 CVEs in aks-gpu-cuda-lts image

IcM 862176737 flagged HIGH severity CVEs in gpgv and libssl3t64 for
mcr.microsoft.com/aks/aks-gpu-cuda-lts:580.159.04-202606292144301
(ubuntu 24.04 base). Neither the builder nor final stage ran 'apt
upgrade', so the base image's stale gpgv/libssl3t64 packages were
carried through unpatched into the shipped image.

Add 'apt upgrade -y' in the builder stage and an explicit
apt-get update && apt-get upgrade in the final stage before copying
artifacts, so the shipped image picks up the latest Ubuntu security
patches for these packages.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: runzhen

Dockerfile

@@ -2,7 +2,7 @@ ARG distro=24.04
 
 FROM mcr.microsoft.com/mirror/docker/library/ubuntu:${distro} as gpu
 
-RUN apt update && apt install -y curl xz-utils gnupg2 ca-certificates gettext-base --no-install-recommends
+RUN apt update && apt upgrade -y && apt install -y curl xz-utils gnupg2 ca-certificates gettext-base --no-install-recommends && rm -rf /var/lib/apt/lists/*
 
 ARG DRIVER_VERSION
 ARG DRIVER_URL
@@ -24,6 +24,10 @@ RUN bash download.sh
 
 FROM mcr.microsoft.com/mirror/docker/library/ubuntu:${distro}
 
+# Pull in the latest Ubuntu security patches (e.g. gpgv, libssl3t64) on top of
+# the base image so shipped VHD images don't carry stale, vulnerable packages.
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 COPY --from=gpu /opt/gpu/ /opt/gpu/
 COPY entrypoint.sh /entrypoint.sh 
 COPY install.sh /opt/actions/install.sh