Fix docker image hash update script (#2922)

Simplifies and improves the automated hash update process. Move away
from distro + architecture-aware update to more generic token-based
find-and-replace. This fixes a bug where arm64 image digests were not
properly updated in TF files

This generates
https://github.com/bazelbuild/continuous-integration/pull/2923.