deps: Assorted dependabot updates

[Copilot]

Consolidates all passing dependabot PRs labeled with pick-me to reduce CI cost by landing them as a single batch instead of individually.

Python Dependencies (tools/base/requirements.txt)

• gitpython 3.1.45 → 3.1.46 (build(deps): bump gitpython from 3.1.45 to 3.1.46 in /tools/base #42822)
• aiodocker 0.24.0 → 0.25.0 (build(deps): bump aiodocker from 0.24.0 to 0.25.0 in /tools/base #42735)

GitHub Actions

• github/codeql-action 4.31.7 → 4.31.9 (build(deps): bump github/codeql-action from 4.31.7 to 4.31.9 #42742)
• actions/cache 4.3.0 → 5.0.1 (build(deps): bump actions/cache from 4.3.0 to 5.0.1 #42619)
• actions/upload-artifact 5.0.0 → 6.0.0 (build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 #42620)
• actions/download-artifact 6.0.0 → 7.0.0 (build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 #42623)

Go Dependencies

• google.golang.org/protobuf 1.36.10 → 1.36.11 in:
  • Root go.mod (build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 #42624)
  • contrib/golang/filters/http/test/test_data (build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 in /contrib/golang/filters/http/test/test_data in the contrib-golang group #42625)
  • contrib/golang/upstreams/http/tcp/test/test_data (build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 in /contrib/golang/upstreams/http/tcp/test/test_data in the contrib-golang group #42626)
  • contrib/golang/router/cluster_specifier/test/test_data/simple (build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 in /contrib/golang/router/cluster_specifier/test/test_data/simple in the contrib-golang group #42622)

All commits cherry-picked without conflicts. Changes applied in reverse line number order where files overlap.

Original prompt

this repo has many pending dependabot prs - some are failing, some are passing

ci is expensive - so rather than landing all the passing ones individually i want you to create a merge queue pr that picks the commits from all the passing dependabot prs

ive labelled the passing ones with pick-me - ONLY pick those

note: if any touch the same file then you should apply in reverse order from their affected line nos - this generally avoids conflicts

if there is conflict skip - you are rubbish at resolving we will get it in the next pass

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[repokitteh-read-only]

As a reminder, PRs marked as draft will not be automatically assigned reviewers,
or be handled by maintainer-oncall triage.

Please mark your PR as ready when you want it to be reviewed!

🐱

Caused by: #42838 was opened by Copilot.

see: more, trace.

[repokitteh-read-only]

CC @envoyproxy/dependency-shepherds: Your approval is needed for changes made to (bazel/.*repos.*\.bzl)|(bazel/dependency_imports\.bzl)|(api/bazel/.*\.bzl)|(.*/requirements\.txt)|(.*\.patch).
envoyproxy/dependency-shepherds assignee is @phlax

🐱

Caused by: #42838 was synchronize by Copilot.

see: more, trace.