fix: address trivy CVEs found on 2026-09-05

[github-actions]

Trivy CVE Scan - 2026-09-05

The daily vulnerability scan found HIGH/CRITICAL CVEs in our container images.
Please remediate the vulnerabilities listed below.

Vulnerabilities

CVE	Severity	Package	Installed	Fixed	Image
CVE-2026-14456	HIGH	libssl3t64	3.5.6-1~deb13u2	3.5.7-1~deb13u2	hub-agent
CVE-2026-14456	HIGH	libssl3t64	3.5.6-1~deb13u2	3.5.7-1~deb13u2	member-agent
CVE-2026-14456	HIGH	libssl3t64	3.5.6-1~deb13u2	3.5.7-1~deb13u2	refresh-token
CVE-2026-56854	CRITICAL	golang.org/x/crypto	v0.53.0	0.55.0	refresh-token
CVE-2026-84304	HIGH	google.golang.org/grpc	v1.82.1	1.83.1	hub-agent

Instructions

Go library CVEs:

1. Run: go get <package>@<fixed_version>
2. Run go mod tidy to clean up dependencies.

OS / base-image CVEs:

1. Update the base image in the relevant Dockerfile under docker/.

Then verify:

1. Run make build to verify the build passes.
2. Run make test to verify tests pass.

Review: Request review from @kubefleet-dev/kubefleet-secops on the resulting PR.

Security owners

@kubefleet-dev/kubefleet-secops