tools: fix update-sha.sh so the Envoy API auto-update job works again

[basundhara-c]

The Envoy API is stuck at v1.37.2 because the scheduled update-protobuf job has been failing
on every run, for example:
https://github.com/envoyproxy/java-control-plane/actions/runs/27202007279/job/80308114011

The break is in tools/update-sha.sh:

• release_date was removed from repository_locations.bzl, so find_date aborts the
  script (under set -e -o pipefail) before API_SHAS is written → update-api.sh fails
  with gzip: stdin: not in gzip format.
• The cncf/xds dep was renamed com_github_cncf_xds → xds, leaving XDS_SHA empty.
• find_envoy_sha_from_tag only scanned page 1 of the /tags API.

Fix: tolerate the missing release_date, resolve the tag SHA via /commits/{ref}, and
look up the renamed xds dep.

Verified: ./update-sha.sh v1.38.1 | tee API_SHAS && ./update-api.sh now bumps cleanly to v1.38.1.