store: valid API v2 shared-lock wrappers emit empty-primary warnings

## Bug Report

Please answer these questions before submitting your issue. Thanks!

### 1. Minimal reproduce step (Required)

This tracks TiDB adoption of the confirmed client-go fix in https://github.com/tikv/client-go/pull/2071 for https://github.com/tikv/client-go/issues/2070.

On an API v2/CSE path, decode a `KeyError.Locked` response whose outer `LockInfo` has `LockType=SharedLock`, a valid encoded `Key`, an empty `PrimaryLock`, and at least two valid nested entries in `SharedLockInfos`. Use a production-mode build without the `intest` tag, which suppresses the affected empty-key diagnostic.

The response fixture and regression reproduction are documented in the upstream issue and PR. This tracking issue does not claim a new local TiDB/SQL reproduction.

### 2. What did you expect to see? (Required)

Valid shared-lock wrappers decode without an empty-primary warning. Nested holders and keyspace validation remain intact, and ordinary locks retain their existing diagnostics.

### 3. What did you see instead (Required)

The empty collection primary is passed to `codecV2.DecodeKey`, producing `codecV2.DecodeKey called with empty key. This shouldn't happen in prod` and a stack trace for each valid wrapper. The confirmed impact is excessive warning output; no wrong-result or transaction-protocol failure is claimed.

Update TiDB's client-go dependency to merge commit `787f20af357c9bf88973a91d002b63e8cffce692` to adopt the upstream fix.

### 4. What is your TiDB version? (Required)

Source version: TiDB master at `dc52119f4a`, which pins `github.com/tikv/client-go/v2 v2.0.8-0.20260903102657-08cbf831121a`. A running-server `SELECT tidb_version()` result is not available. Released-version impact has not been established.

Dependency-update PR: https://github.com/pingcap/tidb/pull/71367. Local TiDB tests are delegated to CI as requested.

Start with upstream client-go issue 2070 and PR 2071, then inspect TiDB dependency-update PR 71367 and the pinned version described here. Done means the client-go dependency includes commit 787f20af357c9bf88973a91d002b63e8cffce692 and CI confirms valid shared-lock wrappers no longer emit empty-primary warnings.

Written by the indexing model from the issue text.