chore: update golang.org/x/crypto to v0.56.0

[8BitJonny]

Small dependency update PR to fix small unrelated CVEs that are not exploitable or really relevant for outpost but would still make our security scanner happy if they are fixed 😄

Validated with make build, make test/unit, and go mod verify.

ran codex over it and verified its result. Feel free to object to this LLM mess 😄

CVE	What exploitation requires	Verdict for standard Outpost
CVE-2026-78662	A malicious SSH peer floods channel requests before a channel is established, deadlocking the SSH connection. Affects SSH clients and servers. Fixed in x/crypto v0.56.0.	Not relevant to the reviewed application paths. I found no SSH client/server implementation or SSH package import in Outpost.
CVE-2026-56855	A malicious SSH peer sends crafted messages after channel establishment, deadlocking the SSH connection. Affects SSH clients and servers. Fixed in v0.56.0.	Not relevant to the reviewed application paths, for the same reason: no identified SSH connection through which an attacker could reach the flaw.
CVE-2026-56854	A Go SSH server uses one of the affected authentication callbacks and returns a source-address restriction, which is then ignored. Fixed in v0.55.0.	Not relevant. Outpost has no identified Go SSH server or those authentication callbacks. Its API authentication does not use SSH permissions.

[Copilot]

🟢 Approval recommended

The dependency and checksum updates are consistent, targeted, and compatible with the repository’s Go version.

0 open findings

What changed in this PR

Updates golang.org/x/crypto to address upstream SSH CVEs.

Changes:

• Upgrades x/crypto from v0.54.0 to v0.56.0.
• Updates transitive x/text dependency and checksums.

File	Description
go.mod	Updates indirect dependency versions.
go.sum	Updates module checksums.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[alexluong]

Thanks @8BitJonny, and for the CVE notes. #1148 bumps golang.org/x/crypto to v0.57.0 along with the Go toolchain and the other golang.org/x modules flagged in #1147, so this is covered there. Closing in favor of it.