v0.25.3 binaries embed x/crypto 0.54.0 and rabbitmq/amqp091-go 1.12.0 (HIGH/CRITICAL CVEs) - bump deps for a clean release #409

The v0.25.3 release binaries still embed two vulnerable dependency versions, all flagged by image vulnerability scanners (we scan our foreman-proxy container images with Trivy, --exit-code 1 on HIGH/CRITICAL, and every dockerize release so far fails the gate on Go-side deps):

golang.org/x/crypto v0.54.0 (indirect, via sprig):

• CVE-2026-56854 (GHSA-...) - fixed in 0.55.0
• CVE-2026-78662 (GO-2026-6354) - fixed in 0.56.0
• CVE-2026-56855 (GO-2026-6355) - fixed in 0.56.0

github.com/rabbitmq/amqp091-go v1.12.0 (pulled in by the amqp wait support):

• CVE-2026-77403, CVE-2026-77404, CVE-2026-77405 (CRITICAL), CVE-2026-77406, CVE-2026-77407, CVE-2026-77408, CVE-2026-77410, CVE-2026-77411, CVE-2026-77412, CVE-2026-79921 - all fixed in 1.13.0
• CVE-2026-107386 - fixed in 1.14.0

Ask: bump both pins (x/crypto >= 0.57.0, amqp091-go >= 1.14.0) and cut a patch release - that clears every HIGH/CRITICAL finding on the release binaries. Verified with trivy against a local build with these two bumps: zero findings.

I opened PR #410 with the go.mod/go.sum bump.