resolve cve

- golang.org/x/net replace pin v0.41.0 -> v0.55.0 (CVE-2026-25681,
  CVE-2026-27136, CVE-2026-33814, CVE-2026-39821, CVE-2026-42502)
- golang.org/x/crypto replace pin v0.37.0 -> v0.52.0
- go directive 1.23.0 -> 1.25.0 (required by x/net v0.55.0)

resolve cve

patch CVE-2025-22872

bump x/net x/crypto

fix vuln signature

Update changelog