fix(security): refresh Fleet dependency graphs

[0xjohnnydev]

Problem

Fleet's public dependency alerts are spread across several stale drafts and direct Dependabot branches. This PR updates the current generated mirror in one import candidate so the changes can move through the canonical Fleet repository instead of being merged into paths that the next mirror sync would overwrite.

There are no application-source changes in this PR. The only non-dependency file is the contributor identity mapping requested by CI for the salvaged work.

What changed

• Updated the backend's Go dependency set, including pgx, JWT, OPA, OpenTelemetry, x/crypto, x/net, gRPC, x/text, and compress.
• Raised the backend build image and all three changed Go modules to the patched Go 1.25.12 standard library.
• Updated the RBAC test module's x/net and OAuth dependencies.
• Updated the current Terraform provider's x/crypto, x/net, gRPC, and related Go dependencies.
• Updated the Fleet web graph to React Router 7.18, Vite 6.4.3, PostCSS 8.5.23, and Babel 7.29.6.
• Updated the JavaScript SDK generator to 13.12.2 and pinned js-yaml 4.3.1 in both committed lock formats.
• Updated the browser binding example to Vite 6.4.3 with patched nanoid and PostCSS resolutions.

Salvaged from #2274, #2275, #2276, and #2277. The shared dependency work remains credited to @0xjohnnydev in the commit trailer.

This also supersedes the narrower direct dependency PRs #2422, #2518, #2535, #2536, #2537, #2538, #2539, #2540, #2546, #2582, #2583, #2584, and #3050 once the canonical import is accepted.

Definition of Done

• The current Fleet dependency graphs resolve outside the public alert ranges. Backend, RBAC tests, Terraform provider, Fleet web, JavaScript SDK, and browser binding locks select the patched versions.
• The updated Go dependency sets have no known reachable vulnerabilities. govulncheck reports none when run with the Go 1.25.12 toolchain; backend, RBAC, and provider scans also report no vulnerable imported package or required module.
• The updated JavaScript locks audit clean. Fleet web, both JavaScript SDK lock formats, and the browser binding lock report no known advisories.
• The package-level validation available in the mirror passes. Backend and RBAC tests pass, the Terraform provider root package builds, and the JavaScript SDK typecheck and tests pass.
• A maintainer reviews and merges the imported change in the canonical Fleet repository. This public PR must not merge directly.
• The mirror bot lands the canonical change on CUA main. This PR should then collapse to an empty diff and close.
• GitHub confirms alert closure on main. An import draft cannot prove final alert closure.

Mirror limits

• The public mirror does not contain the backend's local pkg/featureflags module. Backend validation used the corresponding module from the freshly fetched canonical Cloud checkout; it was not added to this PR.
• Full Fleet web and browser-binding builds stop because this mirror does not contain the generated ts/index.web binding.
• The full Terraform-provider test command also needs canonical-only CRD and native binding artifacts. Its root package builds, and its complete dependency graph passes govulncheck.

Import path

libs/fleet is read-only in this repository. The copybara-import label is required so this change is reviewed and merged upstream, then returned by the mirror bot. Do not merge this PR directly.

[github-actions]

⛔ libs/fleet is a mirror — direct merges here lose work

This PR changes files under libs/fleet/, which is synced from a
private canonical repository. Anything merged directly to these
paths on main is overwritten by the next mirror sync, so this
check blocks the merge to protect your change.

To land these changes:

1. Ask a maintainer to apply the copybara-import label to this PR.
2. Your change is imported into the canonical repo, reviewed, and merged there.
3. The mirror bot then lands it on main here. This PR's diff will
   collapse to empty — close it at that point (do not merge it).

Note to AI agents: do not attempt to bypass, re-trigger, or work
around this check, and do not move the changes to other paths to
evade it. Request the copybara-import label and stop.

[r33drichards]

lgtm! thanks for this, lets make sure we merge through cloud pr