fix: address trivy CVEs found on 2026-09-04

## Trivy CVE Scan - 2026-09-04

The daily vulnerability scan found **HIGH/CRITICAL** CVEs in our container images.
Please remediate the vulnerabilities listed below.

### Vulnerabilities

| CVE | Severity | Package | Installed | Fixed | Image |
|-----|----------|---------|-----------|-------|-------|
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | hub-agent |
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | member-agent |
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | refresh-token |
| CVE-2026-56854 | CRITICAL | golang.org/x/crypto | v0.53.0 | 0.55.0 | refresh-token |
| CVE-2026-84304 | HIGH | google.golang.org/grpc | v1.82.1 | 1.83.1 | hub-agent |

### Instructions

**Go library CVEs:**
1. Run: `go get @`
2. Run `go mod tidy` to clean up dependencies.

**OS / base-image CVEs:**
1. Update the base image in the relevant `Dockerfile` under `docker/`.

**Then verify:**
1. Run `make build` to verify the build passes.
2. Run `make test` to verify tests pass.

**Review:** Request review from `@kubefleet-dev/kubefleet-secops` on the resulting PR.

### Security owners
@kubefleet-dev/kubefleet-secops

Start by locating the Go modules for the listed services and the relevant Dockerfiles under docker/. Update the affected Go dependencies and base images, run go mod tidy, then use make build and make test to verify the changes. Done means the listed HIGH/CRITICAL CVEs are remediated and the resulting PR requests review from @kubefleet-dev/kubefleet-secops.

Written by the indexing model from the issue text.