feat: derive build matrix from distros and PG versions in extension's metadata

[NiccoloFei]

Description

Previously the build matrix was the cross-product of two hardcoded lists
(distributions × pgVersions), which forced:

1. Every extension to build for each distribution defined in the list
2. Every distribution to share the same exact set of PostgreSQL majors (custom combos were not allowed)

Compute the matrix instead from the explicit (distro, PgMajor) pairs declared in metadata.versions, so each extension can declare their own valid combinations:

• docker-bake.hcl:

  • getBuildMatrix(): collapse the two distributions/pgVersions default variables into a single build
    object that contains explicit pairs of (distro, pgVersion), deriving them from metadata.versions
  • getBuildName() function to centralize the target name generation (this is useful because extension's that want to override variables or add extra args need to declare the correct bake target name inside metadata.hcl)

• dagger/maintenance: mirror the new bake logic in the dagger module. buildMatrix now holds explicit []buildCombo pairs with hasDistribution/contains helpers and deterministic ordering.

  • parseBuildMatrix() now parses the extension's metadata.hcl directly instead of using bake.ParseFiles() and resolving both docker-bake.hcl + metadata.hcl together. Given that, github.com/docker/buildx is no longer needed and has been dropped as a module dependency (hence why all those indirect deps have been removed).

• UpdateOSLibs and GenerateCatalogs updated accordingly.

• Added unit-tests for buildMatrixFromMetadata() and buildMatrix methods.

• Fixed load order between docker-bake.hcl and metadata.hcl to ensure per-extension overriding/appending of labels/annotations/args etc. now works properly.

Type of change

• Update to an existing extension (version bump, fix)
• Shared build infrastructure / tooling change
• Documentation only
• Other (please describe above)

Closes #242

---

Contributor checklist

• My commits are signed off for DCO
  compliance (git commit -s).
• This PR targets the main branch of the upstream repository.
• task checks:all passes locally.
• For changes affecting one or more extensions, the relevant build and E2E
  tests pass (e.g. task bake TARGET=<ext>, task e2e:test:full TARGET=<ext>).
• Any // renovate: comments touched in metadata.hcl / README.md remain
  intact (suite=, depName=, extractVersion=).
• Documentation (README.md, BUILD.md, ...) updated where relevant.

---

Maintainer review checklist

• CI is green for all affected targets / shared changes.
• DCO check passes.
• Change reviewed for correctness and scope; no unintended targets rebuilt.
• // renovate: annotations preserved so automated version tracking keeps
  working.
• If shared infrastructure changed, the _shared filter in
  .github/workflows/bake.yml was updated when all extensions must rebuild.
• PR targets main and is ready to merge.