Trivy: HIGH/CRITICAL vulnerabilities in maintained release branches

## Release-branch security scan

Severity: `HIGH,CRITICAL` · fixable-only: `true` · scan result: `success`
Run: https://github.com/erigontech/erigon/actions/runs/33590647252

| Branch | Commit | CRITICAL | HIGH | Total |
|---|---|---|---|---|
| `release/3.5` | eb0973b | 1 | 1 | 2 |
| `release/3.6` | 16d3c72 | 0 | 1 | 1 |

### Findings

### `release/3.5` @ eb0973b — 2 HIGH/CRITICAL (CRITICAL: 1, HIGH: 1)

| Severity | Package | Installed | Fixed | ID |
|---|---|---|---|---|
| CRITICAL | golang.org/x/crypto | v0.53.0 | 0.55.0 | CVE-2026-56854 |
| HIGH | google.golang.org/grpc | v1.82.1 | 1.83.1 | CVE-2026-84304 |

### `release/3.6` @ 16d3c72 — 1 HIGH/CRITICAL (CRITICAL: 0, HIGH: 1)

| Severity | Package | Installed | Fixed | ID |
|---|---|---|---|---|
| HIGH | google.golang.org/grpc | v1.83.0 | 1.83.1 | CVE-2026-84304 |

Check the dependency declarations for release/3.5 at eb0973b and release/3.6 at 16d3c72, focusing on golang.org/x/crypto and google.golang.org/grpc. Update them to the fixed versions listed in the scan, then rerun the release-branch Trivy security scan. Done means no HIGH or CRITICAL fixable vulnerabilities remain on either branch.

Written by the indexing model from the issue text.