security(openbao): clear residual dependencies after OpenBao 2.6.2

[sbaum1994]

Description

Track the seven High-severity dependency findings expected to remain after the OpenBao 2.6.2 and JWT-plugin refresh in #1477.

Plugin residuals:

• GO-2026-6354 and GO-2026-6355 require golang.org/x/crypto v0.56.0.

Upstream bao binary residuals:

• GO-2026-6303 requires golang.org/x/crypto v0.55.0.
• GO-2026-6354 and GO-2026-6355 require golang.org/x/crypto v0.56.0.
• GHSA-vp52-pcj8-j9qc requires gRPC v1.83.1.
• GHSA-hfg8-hc9c-6c3h requires go-archive v0.3.0.

Definition of Done

• Raise the JWT plugin x/crypto floor from v0.55.0 to v0.56.0.
• Build the OpenBao 2.6.2 bao binary with x/crypto v0.56.0, gRPC v1.83.1, and go-archive v0.3.0, or consume an upstream release containing those floors.
• Preserve the upstream OpenBao 2.6.2 runtime behavior and module set.
• Verify both architecture-specific binaries and run OpenBao/plugin tests.
• Rebuild and rescan the immutable image digest.

The Docker daemon/server advisories in the plugin dependency graph are handled separately through exact-binary reachability evidence; they are not part of these seven patch findings.