chore: update Go toolchain and dependencies to fix security advisories

[johnallers]

Summary

A customer report (CXP-920) flagged that this connector's image/dependencies are old enough to have active vulnerabilities. The Go toolchain part of that (bumping to 1.25.13, which resolves the govulncheck-flagged stdlib CVEs) already landed on main via the .versions.yaml/baton-admin sync, so this PR is now rebased on top of that and scoped to just the remaining leaf-dependency fixes:

• Bump github.com/klauspost/compress v1.18.6 -> v1.18.7 (GO-2026-5841, OOB read in s2).
• Bump go.mongodb.org/mongo-driver v1.17.4 -> v1.17.7 (GO-2026-5327, heap OOB read in GSSAPI error handling).
• go mod tidy && go mod vendor to sync go.sum/vendor/.

One advisory remains: GO-2026-5932 (golang.org/x/crypto/openpgp is unmaintained/unsafe by design) has no fix available upstream. govulncheck confirms this connector's code does not call the affected symbols — it's a dead transitive dependency of another module. Flagging for visibility; no action possible here short of that upstream dependency dropping the package.

Test plan

• go build ./...
• go vet ./...
• golangci-lint run ./... — 0 issues
• go test ./... — no test files in this repo, ran clean
• govulncheck ./... (run explicitly under the Go 1.25.13 toolchain): 0 reachable vulnerabilities, 1 unreached/unfixable module vuln (x/crypto/openpgp, see above)
• .versions.yaml untouched (baton-sdk pin unaffected, matches check-versions.yaml CI gate)

[linear-code]

CXP-920

[johnallers]

Heads up: `test-cloud-version` is failing here with a real `401 Unauthorized` from the live GitLab.com API (`GET /api/v4/groups` for `ci_test_group`), reproduced on rerun (not a flake).

This looks unrelated to the dependency bump in this PR:

• The diff only touches the Go toolchain patch version and two leaf, HTTP-unrelated transitive deps (`klauspost/compress`, `mongo-driver`); nothing in the auth/request path (`pkg/connector/client`, vendored `baton-sdk`/`uhttp`) changed.
• The same job passed cleanly on the last several PRs ([CXH-1974] - Label grants by access path and sync invited-group relationships - GitLab Connector #92, chore: update baton-sdk to v0.18.4 #93, [Steward] Fail pull requests when generated setup artifacts drift (bld-439b8b55ce5d9b03545cbdbd) #96) using the same `BATON_ACCESS_TOKEN` secret.
• The response is a genuine GitLab.com auth rejection (Www-Authenticate challenge), not a client-side error.

Most likely the CI `BATON_ACCESS_TOKEN` secret (a GitLab.com PAT for the `ci_test_group` test account) has expired or been revoked. That's an org-owned credential I don't have access to rotate — flagging so whoever owns it can refresh it. Happy to re-run this job once it's updated.

[github-actions]

Connector PR Review: chore: update Go toolchain and dependencies to fix security advisories

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 6cfef97a56e7.
Review mode: full
View review run

Review Summary

Scanned the complete 89-line PR diff (go.mod, go.sum, vendor/modules.txt, and one vendored s2/dict.go) for security and correctness; no connector code changed, so the Client/Resource/Provisioning criteria are not engaged. The vendored klauspost/compress hunk matches the upstream v1.18.6...v1.18.7 diff byte-for-byte (confirmed against the upstream compare API, so the vendor tree was not hand-edited), and go.mongodb.org/mongo-driver v1.17.4 -> v1.17.7 touches no package vendored here (only bson/* and x/bsonx/bsoncore are vendored; the GSSAPI fix lives in x/mongo/driver/auth), so vendor/ stays consistent with the new module versions and both modules correctly remain // indirect. The earlier finding about the title claiming a Go toolchain bump is now largely moot since base main already carries go 1.25.13, though this diff itself contains no toolchain change.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.

[github-actions]

No blocking issues found.