fix(deps): bump Go dependencies to resolve critical CVEs [rhoai-3.4]

[nsingla]

Summary

Backports CVE fixes to rhoai-3.4 branch (cherry-picked from rhoai-3.3 PR #720):

• golang.org/x/crypto v0.36.0 → v0.52.0 — fixes CVE-2026-42508, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-46597, CVE-2026-39835
• golang.org/x/net v0.38.0 → v0.55.0 — fixes CVE-2026-25681, CVE-2026-27136, CVE-2026-39821
• gopkg.in/go-jose/go-jose.v3 v3.0.4 → v3.0.5 — fixes CVE-2026-34986 (DoS)
• google.golang.org/grpc v1.71.1 → v1.79.3 — fixes CVE-2026-33186 (auth bypass)
• CVE-2026-42294: Webhook DoS fix via io.LimitReader in server/auth/webhook/interceptor.go
• CVE-2026-42296: TemplateReferencing bypass fix via allow-list validation in workflow/controller/operator.go + defense-in-depth sanitization in workflow/util/merge.go

Test plan

• Verify go build ./... succeeds
• Run go test ./... — all existing tests pass
• New unit tests for webhook LimitReader and templateReferencing validation pass
• CI pipeline passes