fix: address trivy CVEs found on 2026-09-11

## Trivy CVE Scan - 2026-09-11

The daily vulnerability scan found **HIGH/CRITICAL** CVEs in our container images.
Please remediate the vulnerabilities listed below.

### Vulnerabilities

| CVE | Severity | Package | Installed | Fixed | Image |
|-----|----------|---------|-----------|-------|-------|
| CVE-2026-56854 | CRITICAL | golang.org/x/crypto | v0.53.0 | 0.55.0 | refresh-token |
| CVE-2026-84304 | HIGH | google.golang.org/grpc | v1.82.1 | 1.83.1 | hub-agent |

### Instructions

**Go library CVEs:**
1. Run: `go get @`
2. Run `go mod tidy` to clean up dependencies.

**OS / base-image CVEs:**
1. Update the base image in the relevant `Dockerfile` under `docker/`.

**Then verify:**
1. Run `make build` to verify the build passes.
2. Run `make test` to verify tests pass.

**Review:** Request review from `@kubefleet-dev/kubefleet-secops` on the resulting PR.

### Security owners
@kubefleet-dev/kubefleet-secops

Start with the Go dependencies used by the refresh-token and hub-agent images, then inspect the relevant Dockerfiles under docker/. Update the two listed packages to their fixed versions, run go mod tidy, and verify with make build and make test. Done means both CVEs are remediated and the resulting PR requests review from @kubefleet-dev/kubefleet-secops.

Written by the indexing model from the issue text.