fix: remediate Harbor dependency and base image vulnerabilities (DEVOPS-44168)

[kycheng]

Origin-branch counterpart of #194 (fork PR) so the pipeline's image-digest commit-back can push (the fork bot cannot push to kycheng/harbor-helm).

Same content as #194 plus the pipeline-generated image tag pins in values.yaml:

• Go deps: golang.org/x/crypto 0.49->0.52, golang.org/x/net 0.52->0.55 (HIGH), go.mongodb.org/mongo-driver 1.14->1.17.7 (MEDIUM)
• GOLANG_IMAGE_VERSION 1.26.3 -> 1.26.4
• Component releases (rebuilt with Go 1.26.4): TRIVY v0.68.3-alauda-9, TRIVY_ADAPTER v0.34.3-alauda-5, REGISTRY v2.8.4-alauda-8
• Photon base ops/photon:5-alauda-202606161048 rebuilt in place by ops
• trivy-scan gate ignores no-fix CVEs CVE-2026-50163 (oras-go), CVE-2026-41889 (pgx v4)

All 8 image trivy-scans pass on the prior run (harbor-all-in-one-stxqn). Supersedes #194.

🤖 Generated with Claude Code

[kycheng]

/retest

[alaudabot]

✅ All checks are passing. No failed tests to rerun.

[kycheng]

/all-in-one

[kycheng]

Pipeline history / why the earlier fork PR (#194) shows red

The vulnerability remediation is complete and validated — on the prior run (harbor-all-in-one-stxqn, commit 9b8ac9b) all 8 image trivy-scan tasks passed (core, portal, registry, registryctl, nginx, jobservice, exporter, trivy-adapter), 0 failures.

The only failing task on #194 was commit, and it is not a security/build failure: the pipeline pins the freshly-built image tags back into values.yaml and pushes that commit to the PR branch. #194's head is on a fork (kycheng/harbor-helm) that the CI bot cannot push to (403), and each commit-back changes the SHA so a fork PR can never converge. The pipeline's built-in fallback pushed the complete state (remediation + image-tag pins) to the origin branch this PR is built from.

This PR (#195) is that origin branch, so the commit-back can push and the pipeline goes fully green. Its values.yaml references the remediated images (2.14.3-g...); #194's still points at the previous build, so merge this PR, not #194.

Residual (accepted, no upstream fix, exempted in the trivy-scan gate): CVE-2026-50163 (oras-go, via trivy binary), CVE-2026-41889 (jackc/pgx v4 LOW). Photon base ops/photon:5-alauda-202606161048 was rebuilt in place by ops (now clean).

[kycheng]

/ready

[kycheng]

/merge

[alaudabot]

🎉 PR Successfully Merged!

Merge details:

• Method: squash
• Merged by: @kycheng
• LGTM votes: 2/1

Approvers:

User	Permission	Valid
@chengjingtao	admin	✅
@yuzichen12123	write	✅

Thank you to all reviewers! 🙏

[kycheng]

/all-in-one

[kycheng]

/integration-test skip_e2e=true