fix: address trivy CVEs found on 2026-09-03

## Trivy CVE Scan - 2026-09-03

The daily vulnerability scan found **HIGH/CRITICAL** CVEs in our container images.
Please remediate the vulnerabilities listed below.

### Vulnerabilities

| CVE | Severity | Package | Installed | Fixed | Image |
|-----|----------|---------|-----------|-------|-------|
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | hub-agent |
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | member-agent |
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | refresh-token |

### Instructions

**Go library CVEs:**
1. Run: `go get @`
2. Run `go mod tidy` to clean up dependencies.

**OS / base-image CVEs:**
1. Update the base image in the relevant `Dockerfile` under `docker/`.

**Then verify:**
1. Run `make build` to verify the build passes.
2. Run `make test` to verify tests pass.

**Review:** Request review from `@kubefleet-dev/kubefleet-secops` on the resulting PR.

### Security owners
@kubefleet-dev/kubefleet-secops

Inspect the relevant Dockerfiles under docker/ for hub-agent, member-agent, and refresh-token, starting with their base-image declarations. Update the base image so libssl3t64 uses 3.5.7-1~deb13u2, then run make build and make test; request review from @kubefleet-dev/kubefleet-secops.

Written by the indexing model from the issue text.