fix(core): bump OpenTelemetry Go SDK to v1.40.0 (CVE-2026-24051)

[loktev-d]

Description

Fix CVE-2026-24051 by bumping go.opentelemetry.io/otel/sdk from vulnerable versions (v1.21.0–v1.34.0) to v1.40.0 for virtualization-artifact, vm-route-forge, dvcr-artifact, virtualization-dra

Why do we need it, and what problem does it solve?

What is the expected result?

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: core
type: fix
summary: fix CVE-2026-24051