fix(ACP-54487): update vulnerable Go dependencies

[wgkingk]

Summary

• update vulnerable Go modules used by bin/registry
  • golang.org/x/crypto v0.49.0 -> v0.53.0
  • golang.org/x/net v0.52.0 -> v0.56.0
  • golang.org/x/sys v0.42.0 -> v0.46.0
  • golang.org/x/text v0.35.0 -> v0.39.0
  • golang.org/x/sync v0.20.0 -> v0.21.0
• replace the removed x/net/http2/h2c wrapper with Go's http.Protocols configuration
• refresh vendored dependencies

Verification

• go test ./registry -run 'Test(ServerProtocols|NextProtos)$' -count=1 with Go 1.25.10
• the same focused test with Go 1.26.2
• go test ./registry ./health/checks -skip '^(TestGracefulShutdown|TestHTTPChecker)$' -count=1
• make test TESTFLAGS='-count=1': all remaining packages passed; the two excluded tests are pre-existing/environmental failures (TestGracefulShutdown also fails on the unchanged base commit, and TestHTTPChecker depends on external www.google.pt connectivity)
• built cmd/registry and verified embedded module versions with go version -m

Related: ACP-54487