Bump golang.org/x/text and golang.org/x/sys to fix vulnerabilities

[hmbrglr]

govulncheck reports a vulnerability that the CLI actually reaches:

GO-2026-5970: infinite loop on invalid input in golang.org/x/text (found in v0.24.0, fixed in v0.39.0)

Execute @ cli/root.go:146
Execute @ github.com/charmbracelet/fang/fang.go:175
DefaultErrorHandler @ github.com/charmbracelet/fang/help.go:121
titleFirstWord @ github.com/charmbracelet/fang/theme.go:206
Caser.String @ golang.org/x/text/cases/cases.go:51

This bumps the indirect dependencies to the lowest versions that fix it and two
other reported (not called) vulnerabilities, without raising the Go version:

• golang.org/x/text v0.24.0 -> v0.41.0 (GO-2026-5970, GO-2026-6629)
• golang.org/x/sys v0.41.0 -> v0.44.0 (GO-2026-5024)
• golang.org/x/sync v0.17.0 -> v0.22.0 (required by x/text)

Before: 1 vulnerability affecting the code, 2 more in required modules.
After: govulncheck ./... finds no vulnerabilities.

Tested: go build for linux/amd64, darwin/arm64 and windows/amd64,
go vet ./... and go test -race ./... all pass.