build(deps): bump golang.org/x/crypto in /encryption

[dependabot]

Bumps golang.org/x/crypto in /encryption from 0.54.0 to 0.57.0.

Updates golang.org/x/crypto from 0.54.0 to 0.57.0

Commits

• 3f62bf1 go.mod: update golang.org/x dependencies
• 86efde5 ssh: reject unexpected message types on established channels
• a6cdac6 ssh: drop traffic on undecided channels
• 39dc44e ssh: don't skip the source-address critical option in CheckCert
• afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
• 89f4e9b x509roots/fallback: update bundle
• 71488c4 ssh/knownhosts: compare only public key portions for revocation
• 82adefa ssh: synchronize unexpected response test
• c757c98 all: upgrade go directive to at least 1.26.0 [generated]
• 593c81a ssh: correctly ignore pre-banner lines
• Additional commits viewable in compare view

[lei-wego]

@dependabot rebase

[mike-wego]

Holding this: it ships no fix that reaches pkg, and it forces Go 1.26 on consumers.

pkg imports only golang.org/x/crypto/hkdf (encryption/ecies/keys.go). The CVEs fixed in v0.55 and v0.56 (GO-2026-6303, GO-2026-6354, GO-2026-6355) are all in x/crypto/ssh, so none reach pkg.

v0.56+ needs Go 1.26, so this PR raises 15 modules from go 1.25.0 to go 1.26.0. pandora (1.24), flight-offer-aggregator (1.25.2) and partner-success-service (1.25.12) import affected modules and build from Dockerfiles pinned to golang:1.24/1.25 images. Those images set GOTOOLCHAIN=local, so the next pkg bump in those services passes CI (setup-go reads go.mod) and then fails the image build with go: go.mod requires go >= 1.26.0 (running go 1.25.12; GOTOOLCHAIN=local).

Could we close this and take the x/* bumps as a planned Go 1.26 floor, once those three services move their images to 1.26?

[yanyi-wego]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.