resolve cve's by updating net, caddy, aws-sdk-go, grpc

[nathanlaceyraft]

govulncheck ./...
This shows CVE's that your code is actually calling, and CVE's that you aren't actually calling but show up with some Vulnerability scanning tools like trivy

Vulnerability #1: GO-2026-4644
Caddy's vars_regexp double-expands user input, leaking env vars and files in
github.com/caddyserver/caddy
More info: https://pkg.go.dev/vuln/GO-2026-4644
Module: github.com/caddyserver/caddy/v2
Found in: github.com/caddyserver/caddy/v2@v2.11.1
Fixed in: github.com/caddyserver/caddy/v2@v2.11.2

Vulnerability #2: GO-2026-4559
Sending certain HTTP/2 frames can cause a server to panic in
golang.org/x/net
More info: https://pkg.go.dev/vuln/GO-2026-4559
Module: golang.org/x/net
Found in: golang.org/x/net@v0.50.0
Fixed in: golang.org/x/net@v0.51.0

Commands run to generate PR
go get golang.org/x/net
go get github.com/caddyserver/caddy/v2
go get github.com/aws/aws-sdk-go
go get google.golang.org/grpc
go mod tidy

Thanks for your consideration!

[nathanlaceyraft]

An additional thought.
I noticed your github actions automatically when a PR came in.
(Instead of having your or another approver authorize the pr first)

I haven't dived into your .github configs.
but it's possible this opens your repo up to having your tokens stolen

https://www.stepsecurity.io/blog/hackerbot-claw-github-actions-exploitation