[CVE] bump oras-go to v2.6.2 and grpc to v1.82.1 (release-v1.40)

[pasanw]

Description

CVE remediation for the operator on release-v1.40 (Calico Enterprise v3.22.7). Indirect dependency bumps only — no operator code changes and no Kubernetes-version change. This branch is deliberately kept on k8s 1.35 to stay aligned with the calico-private core (also on k8s 1.35); see the containerd note below.

• oras.land/oras-go/v2 v2.6.0 → v2.6.2. Clears CVE-2026-50151 and CVE-2026-50163 (oras hardlink path traversal, high 7.1). Both are recorded as fixed = 2.6.2 by OSV and the GitHub Advisory DB, and by the master / release-v1.43 fixes (chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd #5100 / chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd [v1.43] #5101).
• google.golang.org/grpc → v1.82.1. Clears GHSA-hrxh-6v49-42gf / GO-2026-6061.

Both requires carry advisory-naming comments so a future go mod tidy cannot silently revert the pins.

containerd — deliberately not fixed here (VEX)

Three advisories remain on containerd v1.7.33: CVE-2026-50195 (critical 9.9), CVE-2026-53492 (critical 9.6), CVE-2026-53489 (high). They are not resolved in this PR, on purpose:

• containerd 1.7.33 has no fixed version — there is no containerd patch to move to.
• The operator never imports containerd directly; it only pulls it in transitively through Helm. The only way to remove it is to bump Helm to v3.21.3, which drops the dependency. But Helm reaches k8s v0.36 at v3.21.2 and doesn't drop containerd until v3.21.3 — so every containerd-free Helm is already on k8s 1.36. Taking that fix would move this branch to k8s 1.36, a minor bump that would diverge the operator from the calico-private core (on k8s 1.35).
• We are keeping operator/core on the same k8s minor, so the Helm/k8s-1.36 route is deferred on this line. master and release-v1.43 — which are already on k8s 1.36 — take that route (chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd #5100 / chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd [v1.43] #5101).

These three should be VEX'd (no-fix, deferred pending a k8s-1.36 uplift of the v1.40 line), not silently dropped.

Corrections vs the earlier version of this PR (raised in review)

• Stopped at oras v2.6.1 and claimed "v2.6.2 is not the fix" for CVE-2026-50163 — that was wrong (OSV / GHSA / chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd #5100 / chore(deps): bump helm to v3.21.3 and oras-go to v2.6.2 to drop vulnerable containerd [v1.43] #5101 all record fixed = 2.6.2). Now on v2.6.2.
• Carried an enterprise label; removed — the operator ships to OSS and Enterprise alike, and the sibling PRs are unlabelled.

Supersedes the autoclosed Renovate security PRs #5092 (grpc) and #5011 (oras v2.6.1). Renovate keys vulnerability alerts off the default branch, so a release branch's security PR autocloses the moment master is fixed — this branch's exposure would otherwise be invisible to automation after merge, which is part of why it lingered.

Fix-forward: release-v1.41 (grpc v1.75.1 + oras v2.6.0) and release-v1.42 (grpc v1.80.0 + oras v2.6.0) are newer than this branch but still vulnerable — companion PRs to those branches should follow.

Verification

ISS full scan of the rebuilt operator image (gcr.io/tigera-dev/pasan/operator, k8s 1.35 build)
 -> crit/high = 3, all containerd (the VEX'd residue below). No new crit/high introduced.

Cleared (absent from scan):
  oras-go   CVE-2026-50151, CVE-2026-50163
  grpc      GHSA-hrxh-6v49-42gf / GO-2026-6061

Remaining, VEX (no containerd fix; k8s-1.36 uplift deferred to keep operator/core aligned):
  containerd  CVE-2026-50195 (critical 9.9)
              CVE-2026-53492 (critical 9.6)
              CVE-2026-53489 (high)

• go version -m operator confirms oras v2.6.2, grpc v1.82.1, go1.26.5 (boringcrypto/FIPS); k8s client stays 1.35 (unchanged); containerd v1.7.33 still linked (the deferred residue).

Release Note

Bumped oras-go to v2.6.2 and grpc to v1.82.1 to remediate oras-go CVE-2026-50151/CVE-2026-50163 and GHSA-hrxh-6v49-42gf. containerd advisories remain deferred (no containerd fix exists; removal requires a k8s-1.36 uplift not taken on this line).

For PR author

• Tests for change — indirect dependency bumps, no new behaviour; validated by building + scanning the operator image.
• If changing pkg/apis/, run make gen-files — n/a.
• If changing versions, run make gen-versions — n/a (Go module versions).

For PR reviewers

Suggested labels: kind/bug, release-note-required, docs-not-required (no enterprise).