[v14] chore: Bump golang.org/x/crypto to v0.31.0

[codingllama]

Backport #50075 to branch/v14.

Changelog: Updated golang.org/x/crypto to v0.31.0 (CVE-2024-45337)

[rosstimothy]

Does this need a separate update to the plugins?

[codingllama]

Does this need a separate update to the plugins?

Do the plugins actually care about /x/crypto/ssh?

[rosstimothy]

Do the plugins actually care about /x/crypto/ssh?

They use ssh to connect to the cluster 🙃

[codingllama]

Do the plugins actually care about /x/crypto/ssh?

They use ssh to connect to the cluster 🙃

If they don't serve connections I don't think they care. In any case it would be good to update to pacify security scanners. FYI @hugoShaka.

[rosstimothy]

In any case it would be good to update to pacify security scanners

Yeah that was exactly why I asked.

[hugoShaka]

If they don't serve connections I don't think they care.

Yeah, plugins should not be vulnerable as they don't run SSH servers.

In any case it would be good to update to pacify security scanners.

I think the repo plugin is now archived? Prior to the plugin repo merge, we never supported backport and bugfixes to older plugin versions (plugins release mechanism always used the last stable teleport release).

Since the teleport-plugins -> teleport repo merge we do plugin backports the same way we do regular teleport backports. However this doe snot apply to pre-merge plugin versions which are still subject to the old release strategy (no release for older major versions).