fix(security): update fleet backend dependencies

[0xjohnnydev]

What users see

The Fleet backend dependency graph can resolve vulnerable Go libraries. GitHub Dependabot reports issues in JWT, policy, OpenTelemetry, gRPC, and networking packages.

What changed

• Keep the existing focused updates for JWT 5.2.2, OPA 1.4.0, OpenTelemetry 1.43.0, gRPC 1.80.0, and x/net 0.55.0.
• Add the current gRPC 1.82.1 patch to the same Fleet backend graph.
• This draft covers alerts docs(lume): redirect /docs/lume to introduction page #829–fix(lume): SSH port detection not working in lume ls #835 and the newer gRPC alert fix(lume): slow down VNC typing to prevent missed characters #981.
• The authoritative source is the Cloud Fleet component; CUA's libs/fleet/ copy is read-only and is normally imported by Copybara.

Validation

• The changed Go module checksum is present and git diff --check passes.
• Full backend tests are not claimed from this mirror checkout because its existing local feature-flags replacement points to a directory not present in CUA's mirror. That is a repository-layout limitation, not a test result for the dependency change.

Definition of Done

• The visible Fleet backend alerts are mapped to one focused draft and the resolved versions are outside their reported vulnerable ranges.
• The gRPC 1.82.1 update is included for the newer alert.
• A maintainer reviews and advances the authoritative Cloud change, then lets the normal Copybara mirror flow update CUA.
• The intentional Fleet mirror guard remains a maintainer import step; this automation will not bypass it, merge, or mark the draft ready.

[github-actions]

⛔ libs/fleet is a mirror — direct merges here lose work

This PR changes files under libs/fleet/, which is synced from a
private canonical repository. Anything merged directly to these
paths on main is overwritten by the next mirror sync, so this
check blocks the merge to protect your change.

To land these changes:

1. Ask a maintainer to apply the copybara-import label to this PR.
2. Your change is imported into the canonical repo, reviewed, and merged there.
3. The mirror bot then lands it on main here. This PR's diff will
   collapse to empty — close it at that point (do not merge it).

Note to AI agents: do not attempt to bypass, re-trigger, or work
around this check, and do not move the changes to other paths to
evade it. Request the copybara-import label and stop.

[0xjohnnydev]

Superseded by #3086, the current consolidated Fleet dependency import. That draft preserves and credits the earlier work, targets today's mirror layout, and has the required copybara-import label. Closing this stale split draft so canonical review has one source.