docs: clarify ownership and cadence in base image update policy

[Subramaniyajothi6]

Description

Clarifies who owns base-image updates and how often the checks run in docs/base_image_update_policy.md, verified against the actual CI.

• Retitles §2 "Scheduled review cadence" → "Ownership & review cadence" and adds an Ownership table — maintainers own currency + approvals; CI owns automated detection; any contributor may open an update PR — plus a note that there is currently no CODEOWNERS.
• Fixes a stale reference: the scan is the Trivy Vulnerability Scan workflow (.github/workflows/trivy-scan.yml), not a docker-image-scan workflow.
• Makes the cadence precise: the weekly cron is Mondays 06:00 UTC (0 6 * * 1), and documents the previously-omitted triggers — push/PR that touch the Dockerfiles or dependency manifests, plus manual workflow_dispatch.
• Cross-links the Trivy and Docker-hardening workflows and the Contacts / How-to-update sections.

Docs-only — no code or behavior change. References spot-checked against trivy-scan.yml, docker-hardening.yml, and both Dockerfiles; scripts/validate_doc_anchors.py passes.

Related Issues

Closes #869

---

@utksh1 — please review this PR. If you have any suggestions, please comment below.

[utksh1]

Focused change with green checks; approving.