fix: bump vulnerable go dependencies

[weicao]

Summary

修复 kbcli Dependabot security 页里可以在当前依赖体系下安全升级的 Go 依赖：

• golang.org/x/net v0.54.0 -> v0.55.0
• github.com/go-git/go-git/v5 v5.16.5 -> v5.19.1
• github.com/go-git/go-billy/v5 v5.6.2 -> v5.9.0
• oras.land/oras-go/v2 v2.6.0 -> v2.6.2
• github.com/containerd/containerd v1.7.32 -> v1.7.33
• go.mongodb.org/mongo-driver v1.15.1 -> v1.17.7

预期覆盖的 Dependabot alerts：

• fix: fix kbcli addon index update always latest #59 golang.org/x/net < 0.55.0
• chore: fix KB version #58/chore: move init addon repo in index cmd #57/[Improvement] init default addon repo in index cmd #56/chore: fix import kb version #55/[BUG]kbcli login failed #53 oras.land/oras-go/v2 vulnerable ranges up to 2.6.1 or < 2.6.1
• chore: support continuous backup and restore #52/[Features] support continuous backup and restore #51 github.com/containerd/containerd < 1.7.33
• [BUG] update kubeblocks to new componentDefinition API verison #50 go.mongodb.org/mongo-driver < 1.17.7
• fix: modify kubeblocks pkg version #49/feat: use opsrequst to achieve backup and restore #45/feat: addon search #44/chore: add code owner and modify github issue assigness #38/[Features]support kbcli addon index #34/feat: cherry-pick #5801 in Kubeblocks #25/fix: add issue_prerelease.sh #24 github.com/go-git/go-git/v5
• [Improvement] kubeblocks config command do not stop KubeBlocks #40/chore: fix make-test fail #39 github.com/go-git/go-billy/v5 < 5.9.0

Validation

• go mod tidy
• go test ./...
• git diff --check
• go list -m all | rg ... 确认目标模块版本

Boundaries

这轮没有强行修以下 alert，因为本地验证证明会破坏当前 kbcli 编译，或者上游没有可用 patched version：

• chore: add action package #31 helm.sh/helm/v3: 升到 v3.20.2 会拉入 Kubernetes v0.35.1/structured-merge-diff/v6。在仓库现有 replace k8s.io/* => v0.29.14 下会出现 structured-merge-diff/v6 vs v4 类型不匹配；把 k8s replace 也整体升到 v0.35.1 又会和 controller-runtime v0.17.2、troubleshoot v0.57.0 旧 API 不兼容。
• chore: support kbcli milestone and release-notes #20/[Features] Refactor with KubeBlocks new api #22/[BUG] release action failed due to missing script #23/feat: only stop kubeblocks when kubeblocks version is specified #41/[Improvement] add auto-complete for edit config #42/[Features] addon search #43 Docker alerts: 尝试升级 github.com/docker/cli / github.com/docker/docker 后，ORAS v1 和 k3d 仍引用旧 github.com/docker/docker/... 类型，而新版 Docker CLI/client 已拆到 github.com/moby/moby/...，导致类型不兼容。
• [BUG]kbcli cluster describe failed #54 oras.land/oras-go v1: Dependabot 标记的 advisory 没有 first_patched_version，当前可见 v1 最新仍是 v1.2.7，本 PR 不伪造不可验证的修复。

[apecloud-bot]

This branch name is not following the standards: feature/|bugfix/|release/|hotfix/|support/|releasing/|dependabot/

[weicao]

Closing this draft because the branch name ava/fix-dependabot-security-20260714 fails kbcli PR Pre-Check branch policy. Recreated with allowed branch prefix hotfix/fix-dependabot-security-20260714.