fix: remediate reachable Go vulnerabilities

[cmilesio]

What

Update the outbound request dependency chain and add repository-wide security evidence.

Surface	Change
URL and IDNA handling	Select golang.org/x/net 0.57 and compatible text dependencies
TLS and HTTP/3	Pair quic-go 0.59.1 with compatible req 3.58.0 and select x/crypto 0.56
Compression	Select klauspost/compress 1.18.7
Static analysis	Use organization-managed CodeQL without a duplicate repository workflow
Dependency analysis	Run fail-closed govulncheck and produce one verified CycloneDX library SBOM
Repository history	Run pinned full-history Gitleaks
Automation	Pin action commits and add weekly Dependabot updates

The paired req and QUIC update preserves HTTP/3 compilation while removing the vulnerable QUIC release. There is no public API, configuration, stored-data, or minimum-Go change because HTTPX already requires Go 1.27.

Why

The affected normalization and TLS code is reached by normal outgoing requests. Fixing the complete dependency graph removes that exposure, while the added controls make future changes to the same request path independently reviewable.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.