fix: address trivy CVEs found on 2026-08-18

[github-actions]

Trivy CVE Scan - 2026-08-18

The daily vulnerability scan found HIGH/CRITICAL CVEs in our container images.
Please update the affected Go dependencies in go.mod to the fixed versions listed below,
then run go mod tidy and verify the build passes with make build.

Vulnerabilities

CVE	Severity	Package	Installed	Fixed	Image
CVE-2026-33818	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	hub-net
CVE-2026-33818	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	mcs
CVE-2026-33818	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	member-net
CVE-2026-39821	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	hub-net
CVE-2026-39821	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	mcs
CVE-2026-39821	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	member-net
CVE-2026-56853	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	hub-net
CVE-2026-56853	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	mcs
CVE-2026-56853	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	member-net
CVE-2026-56858	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	hub-net
CVE-2026-56858	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	mcs
CVE-2026-56858	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	member-net
CVE-2026-56859	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	hub-net
CVE-2026-56859	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	mcs
CVE-2026-56859	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	member-net
CVE-2026-56860	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	hub-net
CVE-2026-56860	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	mcs
CVE-2026-56860	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	member-net
CVE-2026-56862	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	hub-net
CVE-2026-56862	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	mcs
CVE-2026-56862	HIGH	stdlib	v1.25.12	1.25.13, 1.26.6, 1.27.0-rc.3	member-net

Instructions

1. For each Go library CVE, run: go get <package>@<fixed_version>
2. Run go mod tidy to clean up dependencies.
3. Run make build to verify the build passes.
4. Run make test to verify tests pass.

Security owners

@Azure/fleet-networking-security