go.mod: bump security-flagged dependencies and go directive to 1.25

[rcooney-sh]

Security bundle 0710-B1 from the 2026-07-10 Aikido triage. One lockfile-only go get sweep of every dependency Aikido flagged in this repo's initial scan, plus the go directive EOL fix:

• golang.org/x/crypto 0.22.0 -> 0.52.0 (SEC-385)
• golang.org/x/net 0.24.0 -> 0.55.0 (unfiled criticals, grp 30299739)
• google.golang.org/grpc 1.63.2 -> 1.79.3 (unfiled critical, grp 35003225)
• golang.org/x/oauth2 0.19.0 -> 0.34.0 (SEC-387; MVS required >= 0.34 for grpc 1.79)
• golang.org/x/sys 0.19.0 -> 0.45.0 (SEC-401)
• github.com/golang-jwt/jwt/v5 5.2.1 -> 5.2.2 (SEC-391)
• github.com/mostynb/go-grpc-compression 1.2.2 -> 1.2.3 (SEC-399, zstd decompression DoS on the gRPC serving path reachable from customer VMs)
• azidentity 1.5.2 -> 1.6.0 (SEC-394)
• go directive 1.21 -> 1.25 (go 1.21 EOL, grp 21231700)

Also fixes one non-constant format string in cache/disk/options.go that go1.25 vet rejects, and adds .github/dependabot.yml (gomod + github-actions, weekly, grouped) per our sustainability policy.

Operational risk: GREEN. This fork is consumed as a library by the fa agent (bound to the VM bridge with the asset API disabled); none of the bumped code paths are auth-critical in our deployment (fa installs its own interceptors). Validated locally: go build ./... and go test ./server/... ./cache/... ./utils/... all pass.

Follow-up after merge: bump the replace pin in FastActions/fa agent/go.mod to the new fork commit so the fix actually ships in the agent binary.

Linear: SEC-385, SEC-387, SEC-391, SEC-394, SEC-399, SEC-401

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is enabled. (Staging)}

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit e61698e. Configure here.}

[linear-code]

SEC-394

SEC-387

SEC-391

SEC-399

SEC-385

SEC-401