chore(deps): bump go-libp2p and p2p-forge, bound broker HTTP timeout

[gacevicljubisa]

Checklist

• I have read the coding guide.
• My change requires a documentation update, and I have done it.
• I have added tests to cover my changes.
• I have filled out the description and linked the related issues.

Description

Bumps go-libp2p v0.48.0 → v0.49.0 and ipshipyard/p2p-forge v0.7.0 → v0.10.1, and sets an explicit HTTP timeout on the p2p-forge client.

Fixes picked up by the upgrades:

• p2p-forge v0.9.1 — AutoTLS registration fails with 401 against load-balanced endpoints. The PeerID-auth handshake is two requests, and without a session-affinity cookie the second can hit a backend that never minted the challenge. Bee's default is registration.libp2p.direct, exactly the affected endpoint.
• p2p-forge v0.10.0 — gates first-time issuance on a broker health check instead of running doomed ACME flows that certmagic retries with backoff for weeks.
• p2p-forge v0.10.1 — a node offline long enough for its certificate to expire now discards the expired cert and re-issues, instead of looping forever on an ACME ARI replaces rejection.
• go-libp2p v0.49.0 — fixes a deadlock when Conn.Close is called from a connection-notification path (bee disconnects peers from exactly there, on handshake failure and blocklisting), plus address-reachability-manager fixes and a 64-address-per-peer peerstore cap.

The one code change: p2pforge.WithHTTPClient(&http.Client{Timeout: forgeHTTPTimeout}). The DNS-01 challenge POST previously went through http.DefaultClient, which has no timeout, and nothing in the certmagic ACME path sets a deadline on the context it hands down, so a stalled broker connection would hang for the lifetime of the node. WithHTTPClient is new in p2p-forge v0.8.1.

Every go.mod line is a consequence of these two upgrades — go mod tidy on master produces no diff. Notable transitive bumps: certmagic v0.21.6 → v0.25.3, prometheus/client_golang v1.22.0 → v1.24.1, libdns v0.2.2 → v1.1.1. quic-go stays at v0.60.0.

Verified: go build ./... and go vet ./... clean, golangci-lint run ./pkg/p2p/... reports 0 issues, go test -race ./pkg/p2p/... passes. The two failures in go test ./... (TestPanicRespond, TestGsocWebsocketMessageOrdering) reproduce identically on master. Not run: make test-integration and a cluster smoke test — worth a beelocal run before merge, since the prometheus/client_golang jump touches every metrics package.

Open API Spec Version Changes (if applicable)

None.

AI Disclosure

• This PR contains code that has been generated by an LLM.
• I have reviewed the AI generated code thoroughly.
• I possess the technical expertise to responsibly review the code generated in this PR.