Clear remaining Dependabot alerts (oras-go, uuid)

[nabramovitz]

Clears the 12 open Dependabot alerts.

• Bump oras.land/oras-go/v2 to 2.6.1 in src/jetstream and the kubernetes plugin module (transitive via helm's registry client). Patches credential forwarding across registry redirects and via unvalidated Location headers, file-store symlink traversal, and Bearer-realm credential exfiltration - 8 alerts across the two go.mod files.
• Override uuid to 11.1.1 in the devkit. uuid 8.3.2 comes in via sockjs (webpack-dev-server transport) and misses buffer bounds checks in v3/v5/v6; sockjs only calls uuid.v4() and uuid 11 keeps the CJS entry point it requires. Devkit tsc build verified.

Dismissed with justification rather than forced:

• The oras tar-hardlink advisory has no patched release; the vulnerable content/file store is not linked into either binary (go list -deps shows only content/memory).
• The esbuild dev-server advisory is Windows-only and low; vite 7.3.5 pins esbuild ^0.27.0, and overriding against a declared range is what broke the devkit in chore(deps): bump esbuild and @angular-devkit/build-angular in /src/frontend/packages/devkit #5626. The root esbuild is already 0.28.1.

Full make check gate is green; both Go modules build with 2.6.1.

[norman-abramovitz]

LGTM