Upgrade golang.org/x/net to fix CVEs (v5.4.42)

[reinkrul]

Summary

• Upgrade golang.org/x/net from v0.58.0 to v0.60.0
• golang.org/x/crypto, sync, sys, term and text move up one minor version, because the new x/net requires them
• Add release notes for v5.4.42

The Go 1.26.9 upgrade (v5.4.41) fixed these HTTP/2 issues in the standard library, but the same code in golang.org/x/net/http2 (used by gRPC) was still affected. Trivy flags all five on the published v5.4.41 image; govulncheck reports GO-2026-6617 as reachable.

Advisory	CVE	Description
GO-2026-6603	CVE-2026-78659	HTTP/2 server memory exhaustion due to Trailer headers
GO-2026-6610	CVE-2026-78660	HTTP/2 transport accepts malformed framing-related headers
GO-2026-6611	CVE-2026-78669	Excessive CPU from repeated initial window changes
GO-2026-6612	CVE-2026-78663	Double flow control refund on HTTP/2 server streams
GO-2026-6617	CVE-2026-97032	HTTP/2 server crash due to HPACK encoder race

Verification

• GOTOOLCHAIN=go1.26.9 govulncheck ./...: no reachable vulnerabilities. One unreachable finding remains: GO-2026-5932 in golang.org/x/crypto, which has no fixed version yet.
• trivy image --ignore-unfixed on an image built from this branch (no build cache): no findings, OS packages included.

Same fix for master: #4627.

Assisted by AI