Address GO-2025-3487

[XSAM]

Fix https://pkg.go.dev/vuln/GO-2025-3487 by bump golang.org/x/crypto to v0.35.0

Waiting for #6853 to be merged to prevent generating the toolchain directive in go mod. It seems go mod tidy would add the toolchain directive if the go directive is needed to be changed. And, the golang.org/x/crypto:v0.35.0 needs Go 1.23. https://cs.opensource.google/go/x/crypto/+/master:go.mod;l=3

---

After #6853 is merged, it is now good. No more automatic added go directive after go mod tidy. Not sure if it is a bug of Go or not 🤷‍♂️.

[pellared]

I am not sure if we need a changelog for it.
govulncheck has not detected that we are calling the vulnerable code.
I think we can simply supersede this PR with #6829.
Thoughts?

[dmathieu]

I agree we don't need a changelog. We also wouldn't have created one if this had been opened by renovate.

[pellared]

#6829 is merged