plugin/ dependencies pinned at versions with published security advisories

### Summary

`plugin/go.mod` pins several dependencies at versions with published security advisories; container scans (e.g. Trivy) of images built from `plugin/` flag them. Affected: grpc 1.77.0, x/crypto 0.45.0, x/net 0.47.0, x/text 0.31.0, x/sys 0.38.0, go-jose/v4 4.1.3, protobuf 1.36.10.

### Proposed fix

Bump each to its security-fix release (grpc 1.82.1, x/crypto 0.53.0, x/net 0.56.0, x/text 0.39.0, x/sys 0.46.0, go-jose/v4 4.1.4, protobuf 1.36.11). No API changes; `go build ./...` and `go vet ./...` pass.

Review plugin/go.mod and the listed dependency versions first. Bump grpc, x/crypto, x/net, x/text, x/sys, go-jose/v4, and protobuf to the proposed security-fix releases, then run go build ./... and go vet ./.... Done means the commands pass and the pinned versions no longer match the advisories.

Written by the indexing model from the issue text.