Backport of chore: Update dependencies for cve into release/0.21.x

[hc-github-team-secure-boundary]

Backport

This PR is auto-generated from #6768 to be assessed for backporting due to the inclusion of the label backport/0.21.x.

🚨

Warning automatic cherry-pick of commits failed. If the first commit failed,
you will see a blank no-op commit below. If at least one commit succeeded, you
will see the cherry-picked commits up to, not including, the commit where
the merge conflict occurred.

The person who merged in the original PR is:
@moduli
This person should resolve the merge-conflict(s) by either:

• Manually completing the cherry picks into this branch
• Creating a new branch and manually cherry-picking all commits being backported

merge conflict error: POST https://api.github.com/repos/hashicorp/boundary/merges: 409 Merge conflict []

The below text is copied from the body of the original PR.

---

Description

This PR updates dependencies to resolve the following CVEs

⚠︎ found NVD reported vulnerability CVE-2026-39822 in cpe:2.3:a:golang:go:1.26.4:*:*:*:*:*:*:*
        to-scan.6eb8/boundary:1:1
    ⚠︎ found NVD reported vulnerability CVE-2026-42505 in cpe:2.3:a:golang:go:1.26.4:*:*:*:*:*:*:*
        to-scan.6eb8/boundary:1:1
    ⚠︎ found NVD reported vulnerability CVE-2026-39822 in cpe:2.3:a:golang:go:1.26.4:*:*:*:*:*:*:*
        to-scan.6eb8/boundary:1:1
    ⚠︎ found NVD reported vulnerability CVE-2026-42505 in cpe:2.3:a:golang:go:1.26.4:*:*:*:*:*:*:*
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5023 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5029 in golang.org/x/net@v0.53.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5018 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-rm3j-f69w-wqmq in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-w879-237q-wc7r in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-jppx-rxg9-jmrx in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-6061 in google.golang.org/grpc@v1.79.3
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5006 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5027 in golang.org/x/net@v0.53.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-5cv4-jp36-h3mw in golang.org/x/net@v0.53.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-q4h4-gmj2-qvw2 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-9m57-25v3-79x9 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5025 in golang.org/x/net@v0.53.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5019 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5021 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5761 in github.com/opencontainers/runc@v1.2.8
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-qpw4-5x99-6vjp in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5016 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5158 in go.opentelemetry.io/otel@v1.41.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5015 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5014 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-89gr-r52h-f8rx in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5033 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5024 in golang.org/x/sys@v0.43.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5932 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-x527-x647-q7gg in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5026 in golang.org/x/net@v0.53.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5970 in golang.org/x/text@v0.36.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-vgwf-h737-ff37 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5942 in golang.org/x/net@v0.53.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-45gg-vh54-h5m9 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-f5wc-c3c7-36mc in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5030 in golang.org/x/net@v0.53.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-5cgq-3rg8-m6cv in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5013 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5028 in golang.org/x/net@v0.53.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-hrxh-6v49-42gf in google.golang.org/grpc@v1.79.3
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5020 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5005 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-78mq-xcr3-xm33 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GO-2026-5017 in golang.org/x/crypto@v0.50.0
        to-scan.6eb8/boundary:1:1
    ⚠︎ found OSV reported vulnerability GHSA-xjvp-4fhw-gc47 in github.com/opencontainers/runc@v1.2.8
        to-scan.6eb8/boundary:1:1

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.
  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

---

Overview of commits

• d801b17

• ac8c874

[hashicorp-cla-app]

All committers have signed the CLA.