fix(deps): upgrade grpc and x/text to fix GO-2026-6061 and GO-2026-5970

[stevenvegt]

Summary

• Upgrade google.golang.org/grpc from v1.79.3 to v1.82.1
• Upgrade golang.org/x/text from v0.37.0 to v0.39.0 (same fix as fix(deps): upgrade otel and x/text to fix CVEs in V6.2 #4428 on V6.2)
• Add release notes entries under a new Unreleased section

Fixes the following vulnerabilities:

Advisory	Package	Description
GO-2026-6061	google.golang.org/grpc	Vulnerabilities in the HTTP/2 transport server implementation and the xDS RBAC authorization engine
GO-2026-5970	golang.org/x/text	norm.Iter could enter an infinite loop on input containing invalid UTF-8 bytes

Verified with go build ./... and govulncheck ./... (0 vulnerabilities affecting the code after the upgrades).

Assisted-by: AI

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.