deps: bump the go-minor group across 1 directory with 2 updates

[dependabot]

Bumps the go-minor group with 2 updates in the / directory: github.com/go-jose/go-jose/v4 and golang.org/x/crypto.

Updates github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5

Release notes

Sourced from github.com/go-jose/go-jose/v4's releases.

v4.1.5

Fixed security issues

• cipher/cbc_hmac: don't panic on empty ciphertext (#292)
• cipher/cbc_hmac: don't panic on invalid key (#291)
• json: limit stack depth (#290)
• jwt: reject out-of-range NumericDate values (#278)
• Check alg against pubkey curve during verify. (#293)
• Reject malformed Ed25519 JWKs (#250)
• jws: choose verification key per-signature (#243)

Changed

• Verify OpaqueSigner's Public() return is public (#260)
• jws: skip signature on ErrJWKSKidNotFound (#248)
• Handle JWE JSON without protected header (#240)
• jws: don't strip internal whitespace before parsing JSON (#239)
• jws: fewer calls to OpaqueSigner.Public() (#224)
• Return a specific error when parsing empty string (#216)
• Reject typed nil at Verify time (#285)

Commits

• b10771e Reject typed nil at Verify time
• 56f3866 Check alg against pubkey curve during verify. (#293)
• 74114c2 cipher/cbc_hmac: don't panic on empty ciphertext (#292)
• 6b364f3 cipher/cbc_hmac: don't panic on invalid key (#291)
• a31af25 json: limit stack depth (#290)
• 7f5beb3 jwt: reject out-of-range NumericDate values (#278)
• e37f31a Test on Go 1.26 and 1.27 (#284)
• 5b371ae Reject malformed Ed25519 JWKs (#250)
• ad7f32d Bump actions/setup-python from 6 to 7 (#275)
• 1563054 Bump actions/setup-go from 6 to 7 (#274)
• Additional commits viewable in compare view

Updates golang.org/x/crypto from 0.54.0 to 0.56.0

Commits

• 86efde5 ssh: reject unexpected message types on established channels
• a6cdac6 ssh: drop traffic on undecided channels
• 39dc44e ssh: don't skip the source-address critical option in CheckCert
• afebf4c x509roots/fallback/bundle: make subjectsEqual stricter on Go 1.27+
• 89f4e9b x509roots/fallback: update bundle
• 71488c4 ssh/knownhosts: compare only public key portions for revocation
• 82adefa ssh: synchronize unexpected response test
• c757c98 all: upgrade go directive to at least 1.26.0 [generated]
• 593c81a ssh: correctly ignore pre-banner lines
• 46efc8b acme: add crypto.SignMessage test coverage
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.