fix(deps): update dependencies and allow loopback upstreams on fiber v3.5.0

Update all direct and indirect Go dependencies. Notable bumps are
gofiber/fiber v3.4.0 to v3.5.0, gofiber/contrib websocket v1.2.0 to
v1.2.6, fasthttp v1.72.0 to v1.74.0, gookit/goutil v0.7.6 to v0.8.0,
go-redis v9.20.1 to v9.22.0, pgx v5.10.0 to v5.11.0, OpenTelemetry
v1.44.0 to v1.46.0, grpc v1.82.1 to v1.83.2 and testify v1.11.1 to
v1.12.1. The go directive moves to 1.26.0 because websocket v1.2.6
requires it.

fiber v3.5.0 adds an SSRF dial guard to clients registered with
proxy.WithClient. The guard rejects loopback and private upstreams by
default. This proxy gets its upstream from operator configuration, and
sidecar deployments point it at localhost. Set
proxy.SecurityPolicy{AllowPrivateIPs: true} so these upstreams keep
working. This change also unblocks the nightly autoupdate workflow,
which failed on this guard.

Claude-Session: https://claude.ai/code/session_01Fu2wXqGUrfVBi5aLafKk8U

main.go

@@ -442,6 +442,10 @@ func parseConfig() {
 
 	// Create HTTP client with the optimized parameters
 	c.Client.FastProxyClient = createFasthttpClient(&c)
+	// fiber v3.5.0+ guards clients registered via proxy.WithClient against
+	// loopback/private upstreams. The upstream is operator-configured
+	// (HOST_GRAPHQL) and is commonly a localhost sidecar, so allow it.
+	proxy.WithSecurityPolicy(proxy.SecurityPolicy{AllowPrivateIPs: true})
 	proxy.WithClient(c.Client.FastProxyClient) // Setting the global proxy client
 	// API configurations
 	c.Server.EnableApi = getDetailsFromEnv("ENABLE_API", false)