build(deps): bump golang.org/x/net to v0.55.0 (#1308)

## Summary
- Bumps `golang.org/x/net` from v0.53.0 to v0.55.0 to fix
[GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) (failure to reject
ASCII-only Punycode-encoded labels in `golang.org/x/net/idna`).
- govulncheck flagged the vuln via `auth.DefaultHTTPKeyFetcher.FetchKey`
→ `http.Client.Do` → `idna.ToASCII` at
`internal/api/handlers/v0/auth/http.go:191`.
- Also brings in associated `x/crypto`, `x/sys`, `x/text` bumps via `go
mod tidy`.

This unblocks open dependabot PRs (e.g. #1298) that are failing CI on
the same govulncheck finding despite not touching the root module.

## Test plan
- [x] `go build ./...`
- [x] `govulncheck` no longer reports GO-2026-5026 locally
- [ ] CI passes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

go.mod

@@ -70,12 +70,12 @@ require (
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	golang.org/x/crypto v0.50.0 // indirect
-	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/crypto v0.51.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/api v0.274.0 // indirect
 	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect