fix: update minimum google-gax to avoid taffydb vulnerabilities (#1695)

https://togithub.com/advisories/GHSA-mxhp-79qh-mcx6

fixes https://togithub.com/googleapis/nodejs-pubsub/issues/1692

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:
- [x] Make sure to open an issue as a [bug/issue](https://togithub.com/googleapis/nodejs-pubsub/issues/new/choose) before writing your code!  That way we can discuss the change, evaluate designs, and agree on the general idea
- [x] Ensure the tests and linter pass
- [x] Code coverage does not decrease (if any source code was changed)
- [x] Appropriate docs were updated (if necessary)

Fixes #1692  🦕

Note: If you are opening a pull request against a `legacy` branch, PLEASE BE AWARE that we generally won't accept these except for things like important security fixes, and only for a limited time.

package.json

@@ -58,7 +58,7 @@
     "arrify": "^2.0.0",
     "extend": "^3.0.2",
     "google-auth-library": "^8.0.2",
-    "google-gax": "^3.5.2",
+    "google-gax": "^3.5.6",
     "heap-js": "^2.2.0",
     "is-stream-ended": "^0.1.4",
     "lodash.snakecase": "^4.1.1",