[matiasdaloia]

Summary

Upgrades dependencies to close every open Go Dependabot alert in this repo:

• google.golang.org/grpc v1.80.0 -> v1.83.1
• golang.org/x/net v0.51.0 -> v0.57.0 (v0.55.0 fixes the alert; the OpenTelemetry v1.45.0 exporters require v0.57.0)
• go.opentelemetry.io/otel v1.42.0 -> v1.45.0, plus otel/sdk (v1.40.0), otlptrace and otlptracegrpc -> v1.45.0
• github.com/antchfx/xpath v1.2.0 -> v1.3.6

go mod tidy also moved golang.org/x/sys, golang.org/x/text, genproto/googleapis/*, grpc-gateway/v2, go-logr/logr and other OpenTelemetry modules. The go directive stays at 1.25.0, so no CI or Dockerfile Go pin changed.

Alerts fixed

Severity	Package	Advisory	Summary
high	github.com/antchfx/xpath	GHSA-65xw-vw82-r86x	XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustion
high	google.golang.org/grpc	GHSA-2v4p-qf9q-27wj	gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers
high	google.golang.org/grpc	GHSA-hrxh-6v49-42gf	gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
high	google.golang.org/grpc	GHSA-vp52-pcj8-j9qc	gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
high	go.opentelemetry.io/otel/sdk	GHSA-hfvc-g4fc-pqhx	opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
medium	golang.org/x/net	GHSA-5cv4-jp36-h3mw	Go Net HTML parser is vulnerable to denial of service
medium	google.golang.org/grpc	GHSA-qc2q-p7wx-3px3	gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
low	go.opentelemetry.io/otel/exporters/otlp/otlptrace	GHSA-8wmf-6v46-5gfg	OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
low	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc	GHSA-8wmf-6v46-5gfg	OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
low	go.opentelemetry.io/otel/sdk	GHSA-8wmf-6v46-5gfg	OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

Not touched: non-Go alerts (for example samples/packages/package.json) are out of scope for this PR. No Go alert lacked a patched version.

Testing

• go build ./... and go vet ./... pass locally.
• go test ./... passes locally. The version.txt file embedded by pkg/cmd is generated by the Makefile, so I created it temporarily (and removed it) to compile those packages.

Part of the org-wide cleanup of open security alerts.