chore: close go dependency vulnerabilities

[aa1ex]

Summary

Close all Go dependency vulnerabilities from dependabot plus one reachable finding
govulncheck found on top (x/text via oidc). After the change govulncheck ./...
reports 0 reachable vulnerabilities; 2 residual ones are unreachable and have no
fixed versions to bump to.

Changes

• Bumps to first patched versions: x/crypto 0.52.0, grpc 1.82.1, go-jose/v4 4.1.4,
  otel + otel/sdk 1.43.0, cel-go 0.29.0, quic-go 0.59.1, x/net 0.55.0, x/text 0.39.0
  (transitively pulls envoyproxy/go-control-plane v0.14.0).
• dgrijalva/jwt-go (archived, no patched version) → golang-jwt/jwt/v5; it was
  only used for request.OAuth2Extractor.ExtractToken, verification is go-oidc.
• go directive 1.25 (grpc requirement); builders, CI, devcontainer and docs on
  go 1.26 — 1.24 is EOL.
• golangci-lint v1.64.8 → v2.12.2: the last v1 binary is built with go1.24 and
  refuses a go-1.25 module. Config migrated; staticcheck pinned to SA* (v1 parity);
  goconst/prealloc temporarily off — their v2 versions surface 17 pre-existing
  findings, cleanup + re-enable is a follow-up.
• Deprecated x/net/http2/h2c → native net/http Protocols.SetUnencryptedHTTP2;
  dropped a dead handler = mux assignment this exposed.

Testing

make build && make test && make test-e2e — e2e 49/49 passed, images built with
golang:1.26; make lint — 0 issues; govulncheck ./... — 0 reachable.