fix: address CVEs

[shipperizer]

Description

This PR addresses remaining dependencies in rockcraft.yaml to ensure authentik-server is fully patched against security findings reported in #26:

Changes in this PR

1. go-server part:
   • Added go get -u github.com/klauspost/compress to update to >=v1.18.7 (addresses GO-2026-5841).
   • Added go get -u go.opentelemetry.io/otel to update to >=v1.44.0 (addresses GO-2026-5158).
2. python-deps part:
   • Cleaned up uv pip install call by combining --upgrade and alphabetizing PyJWT>=2.13.0 inline with other pinned packages.

Context on #26 Vulnerabilities

• Python Dependencies: The packages reported in Vulnerabilities found for authentik-server:2026.5.3-26.04_18 #26 (aiohttp, cryptography, httplib2, pyasn1, sqlparse) were pinned on main via fix: address CVEs #29. A new rock build/release will update the published OCI image to resolve those findings.
• Go Standard Library: The 8 Go stdlib vulnerabilities reported in /usr/bin/authentik-server (CVE-2026-33818, CVE-2026-39821, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862) were fixed upstream in Go 1.26.6+. With go/1.26/stable currently providing Go 1.26.7, rebuilding the rock resolves these CVEs.

Validation

• Go binary (authentik-server): Built with Go 1.26.7 and scanned with govulncheck -mode=binary; 0 vulnerabilities detected.
• Python venv: Scanned with Trivy; 0 vulnerabilities detected.

Govulncheck Result (authentik-server)

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.

Trivy Scan Result (Python Environment)

Report Summary
┌────────┬────────────┬─────────────────┬─────────┐
│ Target │    Type    │ Vulnerabilities │ Secrets │
├────────┼────────────┼─────────────────┼─────────┤
│ .venv  │ python-pkg │        0        │    -    │
└────────┴────────────┴─────────────────┴─────────┘
Result: Clean (no security findings detected)

Fixes #26