build(deps): bump the golang.org modules, fixing two reachable x/crypto/ssh advisories

[Philip Lombardi (plombardi89)]

Why now

make vulncheck fails on every open pull request, including ones that
touch no Go code:

Reachable with a fix available (2, blocking):
  GO-2026-6354  Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
    module: golang.org/x/crypto@v0.55.0   fixed in: v0.56.0
  GO-2026-6355  Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
    module: golang.org/x/crypto@v0.55.0   fixed in: v0.56.0

Both advisories were published 2026-09-02, after main's last green run
(e1b1d4e, 02:10Z). govulncheck reads a live database, so the tree went red
without a line of code changing. Dependabot groups golang.org/* and runs
weekly with nothing currently open, so waiting means up to a week of red CI on
everything.

This is reachable, not theoretical

Both advisories list Dial and NewClientConn among the affected symbols, and
we call them from a production controller:

Call site	Symbol
cmd/machina/machina/controller/machine_controller.go:157	ssh.Dial (bastion)
cmd/machina/machina/controller/machine_controller.go:511	ssh.Dial
cmd/machina/machina/controller/machine_controller.go:683	ssh.Dial (bastion)
cmd/machina/machina/controller/machine_controller.go:694	ssh.NewClientConn

hack/cmd/forge/forge/infra/ssh.go imports the same package. A hostile or
compromised SSH peer can deadlock the connection, on the bastion path included.

What moved

The whole golang.org group, matching how .github/dependabot.yml has them
grouped. Four modules actually moved; the rest were already current:

Module	From	To
golang.org/x/crypto	v0.55.0	v0.56.0	the security fix
golang.org/x/exp	20260718201538	20260824195058	indirect
golang.org/x/telemetry	20260811182544	20260902144106	indirect
golang.org/x/vuln	v1.2.0	v1.7.0	govulncheck itself, a tool directive

Unchanged because already at latest: x/mod, x/net, x/sync, x/sys,
x/term, x/oauth2, x/text, x/time, x/tools.

No cascade. x/crypto v0.56.0 requires x/net v0.57.0, x/sys v0.47.0,
x/term v0.45.0 and x/text v0.41.0, all of which we already satisfied, and
its go 1.26.0 directive is covered by our go 1.26.6. go mod tidy moved
nothing outside golang.org: the diff is 8 lines of go.mod and 16 of
go.sum, and every changed line is a golang.org/ one.

Note that x/vuln is the scanner, so this changes govulncheck's own version as
well as what it scans. The run below is with v1.7.0.

Verification

Run locally, not inferred:

• make vulncheck exits 0: vulncheck: no reachable vulnerability has an available fix
• go build ./... clean
• make test (which implies make lint locally) clean, 0 issues
• make notice-check: NOTICE is up to date (122 entries). NOTICE records
  dependencies without versions, so a version bump was not expected to drift
  it, but it was checked rather than assumed.
• cmd/machina/... and hack/cmd/forge/..., the two consumers of
  crypto/ssh, pass on their own.

Still reported, still not blocking

GO-2024-3218  Content Censorship in IPFS via Kademlia DHT abuse
              github.com/libp2p/go-libp2p-kad-dht@v0.42.2   no fix available

Unchanged from main. This is the case hack/cmd/vulncheck-gate exists to let
through: reachable, but with no released fix, so no module bump resolves it and
acting on it means dropping or replacing the dependency.

Unblocks

#699 and #700 are both red on this check alone. I will update them from main
once this lands.