fix: address trivy CVEs found on 2026-09-03

[github-actions]

Trivy CVE Scan - 2026-09-03

The daily vulnerability scan found HIGH/CRITICAL CVEs in our container images.
Please remediate the vulnerabilities listed below.

Vulnerabilities

CVE	Severity	Package	Installed	Fixed	Image
CVE-2026-14456	HIGH	libssl3t64	3.5.6-1~deb13u2	3.5.7-1~deb13u2	hub-agent
CVE-2026-14456	HIGH	libssl3t64	3.5.6-1~deb13u2	3.5.7-1~deb13u2	member-agent
CVE-2026-14456	HIGH	libssl3t64	3.5.6-1~deb13u2	3.5.7-1~deb13u2	refresh-token

Instructions

Go library CVEs:

1. Run: go get <package>@<fixed_version>
2. Run go mod tidy to clean up dependencies.

OS / base-image CVEs:

1. Update the base image in the relevant Dockerfile under docker/.

Then verify:

1. Run make build to verify the build passes.
2. Run make test to verify tests pass.

Review: Request review from @kubefleet-dev/kubefleet-secops on the resulting PR.

Security owners

@kubefleet-dev/kubefleet-secops