fix(deps): bump golang.org/x/text to v0.39.0 and x/net to v0.56.0 (#389)

Fixes `GO-2026-5970` (infinite loop on invalid input in `golang.org/x/text`), which is reachable from `doCheck` via the Kubernetes lister and was failing the `vulnerabilities` job in CI.

Also bumps `golang.org/x/net` for `GO-2026-5942`, which govulncheck reports as required but not called.

```
golang.org/x/text v0.37.0 -> v0.39.0
golang.org/x/net  v0.55.0 -> v0.56.0
golang.org/x/sys  v0.45.0 -> v0.46.0  (transitive)
golang.org/x/term v0.43.0 -> v0.44.0  (transitive)
```

All indirect dependencies, so Renovate had not opened a branch for them.

`govulncheck ./...` is now clean and `go test -race ./...` passes.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01PuGr8hyEpEpTX4DyLLwfzG
Reviewed-on: #389

go.mod

@@ -35,11 +35,11 @@ require (
 	github.com/xhit/go-str2duration/v2 v2.1.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/term v0.43.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/term v0.44.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect