fix(deps): google.golang.org/grpc 1.83.1 → 1.83.2 (GHSA-2v4p-qf9q-27wj)

[acamarata]

google.golang.org/grpc is on 1.83.1, inside the vulnerable range of
GHSA-2v4p-qf9q-27wj:

gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing :authority and Host headers

Vulnerable >= 1.83.0, < 1.83.2; patched in 1.83.2. It is an indirect
dependency, surfaced by a Dependabot alert on go.mod.

The change

go get google.golang.org/grpc@v1.83.2 && go mod tidy && go mod vendor

file
go.mod / go.sum	1.83.1 → 1.83.2
vendor/modules.txt	same
vendor/.../internal/transport/http2_server.go	the only vendored source change

The vendor resync is required, not cosmetic. This repo vendors its
dependencies, so bumping go.mod alone leaves vendor/modules.txt pinned at
1.83.1 and go build refuses:

google.golang.org/grpc@v1.83.1: is marked as explicit in vendor/modules.txt,
but not explicitly required in go.mod

Verification

• go build ./... clean.
• vendor/modules.txt reads # google.golang.org/grpc v1.83.2.

Found in an org-wide sweep of open Dependabot alerts filtered to critical/high
with a published fix — this was the only actionable one in cli.