chore(deps): fix dependabot security alerts

[Baoyuantop]

Summary

This PR updates Go module dependencies to resolve the current open Dependabot security alerts for:

• google.golang.org/grpc
• go.opentelemetry.io/otel and go.opentelemetry.io/otel/sdk
• github.com/jackc/pgx/v5
• github.com/moby/spdystream
• filippo.io/edwards25519
• AWS SDK for Go v2 eventstream, S3, Lambda, and CloudWatch Logs modules

It also raises the project Go version, toolchain, and GitHub Actions setup-go version from Go 1.24 to Go 1.25 because github.com/jackc/pgx/v5@v5.9.2 requires Go 1.25 or newer.

Validation

• go mod tidy
• go list -m google.golang.org/grpc go.opentelemetry.io/otel go.opentelemetry.io/otel/sdk github.com/jackc/pgx/v5 github.com/moby/spdystream filippo.io/edwards25519 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream github.com/aws/aws-sdk-go-v2/service/s3 github.com/aws/aws-sdk-go-v2/service/lambda github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
• go vet ./api/... ./cmd/... ./internal/... ./pkg/...
• go test ./api/... ./cmd/... ./internal/... ./pkg/...
• make build

make test was also attempted locally, but the local run could not complete because setup-envtest failed to fetch kubebuilder-tools-1.30.0-darwin-arm64.tar.gz from GCS with 401 Unauthorized; the Go 1.25 downloaded toolchain in this environment also failed the -coverprofile path with go: no such tool "covdata". The non-coverage test suite and build target completed successfully.