fix: address trivy CVEs found on 2026-09-08

## Trivy CVE Scan - 2026-09-08

The daily vulnerability scan found **HIGH/CRITICAL** CVEs in our container images.
Please remediate the vulnerabilities listed below.

### Vulnerabilities

| CVE | Severity | Package | Installed | Fixed | Image |
|-----|----------|---------|-----------|-------|-------|
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | hub-agent |
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | member-agent |
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | refresh-token |
| CVE-2026-56854 | CRITICAL | golang.org/x/crypto | v0.53.0 | 0.55.0 | refresh-token |
| CVE-2026-84304 | HIGH | google.golang.org/grpc | v1.82.1 | 1.83.1 | hub-agent |

### Instructions

**Go library CVEs:**
1. Run: `go get @`
2. Run `go mod tidy` to clean up dependencies.

**OS / base-image CVEs:**
1. Update the base image in the relevant `Dockerfile` under `docker/`.

**Then verify:**
1. Run `make build` to verify the build passes.
2. Run `make test` to verify tests pass.

**Review:** Request review from `@kubefleet-dev/kubefleet-secops` on the resulting PR.

### Security owners
@kubefleet-dev/kubefleet-secops

Inspect the relevant Dockerfiles under docker/ and Go dependency files for hub-agent, member-agent, and refresh-token. Update the listed OS and Go dependencies to their fixed versions, then run make build and make test. Done means the builds and tests pass and a review is requested from @kubefleet-dev/kubefleet-secops.

Written by the indexing model from the issue text.