fix(deps): clear the three reachable govulncheck findings

[mhenrixon]

Summary

The scheduled Security workflow has been failing on main since the clean break — #117, and again in today's run. Three advisories, all reachable:

Advisory	Module	From	To
GO-2026-6061	google.golang.org/grpc	v1.77.0	v1.82.1
GO-2026-5506	go.opentelemetry.io/otel	v1.38.0	v1.43.0
GO-2026-4945	github.com/go-jose/go-jose/v4	v4.1.3	v4.1.4

All three are indirect. grpc and otel arrive through lego's gcloud DNS provider; go-jose through lego's ACME core. The reachable traces run via autocert.Manager.GetCertificate (router.go:602), IdleController.Close (idle_controller.go:178), and the provider registry's init (acme/providers/registry.go:8).

go.mod/go.sum only — no source changes.

Closes #117

Note on the otel version

The advisory names v1.41.0 as the fix floor, but this goes to v1.43.0: grpc v1.82.1 requires it, and go get refuses the combination otherwise. The two have to move together.

Test plan

• go build ./..., go vet ./... — clean
• go test ./... — full suite green
• govulncheck ./... on linux/amd64 — Your code is affected by 0 vulnerabilities
• govulncheck ./... on linux/arm64 — same (both are CI scan targets)

The residual "1 vulnerability in packages you import and 3 in modules you require, but your code doesn't appear to call these" is unchanged by this PR and is not what the workflow gates on — ACCEPTED is empty and the check counts only the reachable set.

Deviations & judgment calls

• otel pinned above its advisory floor, as above — forced by grpc, not a preference.
• No ACCEPTED entries added. The workflow supports suppressing advisories; I did not use it, since all three had real fixes available and suppression would have hidden reachable vulnerabilities rather than resolved them.