fix: address trivy CVEs found on 2026-09-10

## Trivy CVE Scan - 2026-09-10

The daily vulnerability scan found **HIGH/CRITICAL** CVEs in our container images.
Please remediate the vulnerabilities listed below.

### Vulnerabilities

| CVE | Severity | Package | Installed | Fixed | Image |
|-----|----------|---------|-----------|-------|-------|
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | hub-agent |
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | member-agent |
| CVE-2026-14456 | HIGH | libssl3t64 | 3.5.6-1~deb13u2 | 3.5.7-1~deb13u2 | refresh-token |
| CVE-2026-56854 | CRITICAL | golang.org/x/crypto | v0.53.0 | 0.55.0 | refresh-token |
| CVE-2026-84304 | HIGH | google.golang.org/grpc | v1.82.1 | 1.83.1 | hub-agent |

### Instructions

**Go library CVEs:**
1. Run: `go get @`
2. Run `go mod tidy` to clean up dependencies.

**OS / base-image CVEs:**
1. Update the base image in the relevant `Dockerfile` under `docker/`.

**Then verify:**
1. Run `make build` to verify the build passes.
2. Run `make test` to verify tests pass.

**Review:** Request review from `@kubefleet-dev/kubefleet-secops` on the resulting PR.

### Security owners
@kubefleet-dev/kubefleet-secops

Start by locating the relevant Dockerfiles under docker/ and the Go module files for hub-agent, member-agent, and refresh-token. Update the listed OS base image and Go dependencies, run go mod tidy, then verify with make build and make test. Done means the builds and tests pass and the listed HIGH/CRITICAL CVEs are remediated; request review from kubefleet-dev/kubefleet-secops.

Written by the indexing model from the issue text.