fix(deps): update Go dependencies and restore Landlock compatibility

[renovate]

The Go dependency updates require the renamed Landlock ruleset field in x/sys v0.49.0; without the change, EdgeWatch does not compile on Linux. Update the initializer to Handled_access_fs, preserving the existing filesystem access mask, scope mask, and zero defaults for new fields.

Consolidate the reviewed updates in one validated change:

• golang.org/x/crypto v0.58.0 and its required golang.org/x/sys v0.49.0 (fix(deps): update module golang.org/x/sys to v0.49.0 - abandoned #1276).
• golang.org/x/mod v0.42.0 (fix(deps): update module golang.org/x/mod to v0.42.0 - abandoned #1280).
• govulncheck v1.9.0 (chore(deps): update module golang.org/x/vuln to v1.9.0 - autoclosed #1372), shared by the application and bundled Naabu vulnerability scans.

The separate PRs are superseded when this change merges. There are no schema, API, configuration, or documented behavior changes.

Validation: formatting, go vet ./..., and diff checks pass. All GitHub CI and CodeQL checks pass on c6d323e, including frontend/browser checks, all Go race-test shards, container vulnerability scans, and real AMD64/ARM64 sandbox checks. The full local race suite passed all packages except one application writer-wait timeout; both the focused race retry and the full application race suite passed afterward. Sandbox, storage, and web race tests passed in the original run.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
golang.org/x/sys	v0.48.0 -> v0.49.0

[cloudflare-workers-and-pages]

Deploying edgewatch with    Cloudflare Pages

Latest commit:	c6d323e
Status:	✅  Deploy successful!
Preview URL:	https://ba2b38e6.edgewatch-cpd.pages.dev
Branch Preview URL:	https://renovate-golang-org-x-crypto.edgewatch-cpd.pages.dev

View logs

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.