fix: remediate Harbor dependency and base image vulnerabilities

[kycheng]

Harbor 2.14.3 vulnerability remediation (DEVOPS-44168), Trivy DB baseline 2026-07-06.

Go dependencies (subtree/harbor/src)

• golang.org/x/crypto v0.49.0 -> v0.52.0 (HIGH)
• golang.org/x/net v0.52.0 -> v0.55.0 (HIGH)
• go.mongodb.org/mongo-driver v1.14.0 -> v1.17.7 (CVE-2026-2303, MEDIUM)

Base images / toolchain

• GOLANG_IMAGE_VERSION 1.26.3 -> 1.26.4 (all-in-one.yaml, patch-amd64.sh)
• Photon ops/photon 5-alauda-202604171100 -> 5-alauda-202606161048

Component release backfill (all-in-one.yaml)

• TRIVY_VERSION v0.68.3-alauda-7 -> v0.68.3-alauda-8 (fix: remediate Go dependency vulnerabilities trivy#173)
• TRIVY_ADAPTER_VERSION v0.34.3-alauda-2 -> v0.34.3-alauda-4 (fix: remediate Go dependency vulnerabilities harbor-scanner-trivy#55)
• REGISTRY_VERSION unchanged (goharbor-distribution had no HIGH/CRIT/MEDIUM findings)

Known residual (needs ops): latest Photon tag still carries 4 HIGH (libssh2 CVE-2026-55199/55200, sqlite-libs CVE-2026-11822/11824) — requires a rebuilt ops photon image for full acceptance. Harbor portal npm vulns remain upstream-tracked (out of scope here).

🤖 Generated with Claude Code

[kycheng]

Superseded by #195. The security remediation content is identical and all 8 image trivy-scans passed, but this PR is from a fork (kycheng/harbor-helm) and the pipeline's image-digest commit-back step cannot push back to the fork (bot lacks write access), so the pipeline reports failure on the commit task only. #195 is the same change on an origin branch where the commit-back can complete. Please review/merge #195 instead.

[kycheng]

Closing in favor of #195. This fork PR's pipeline can't complete the image-digest commit-back (bot lacks push access to the kycheng/harbor-helm fork), and its values.yaml still references the pre-remediation image tags. #195 is the same remediation on an origin branch with the correct remediated image tags and a green pipeline. Merge #195.