chore(deps): Update go-jose to patched version (GHSA-78h2-9frx-2jm8)

[Wikid82]

Summary

The Grype supply chain scan has identified GHSA-78h2-9frx-2jm8 (HIGH — CVSS 7.5) in two versions of go-jose embedded in the Caddy binary (/usr/bin/caddy):

• github.com/go-jose/go-jose/v3 v3.0.4 → fix available in v3.0.5
• github.com/go-jose/go-jose/v4 v4.1.3 → fix available in v4.1.4

Vulnerability Details

Type: Denial of Service — JWE decryption panic
Advisory: GHSA-78h2-9frx-2jm8
Attack Vector: Crafted JWE input causes unrecoverable panic during decryption

Current Mitigation

• Temporary ignore rules added to .grype.yaml with expiry 2026-05-05
• Charon does not use go-jose directly; this is a transitive dependency embedded in the Caddy binary

Resolution Path

1. Monitor upstream Caddy releases for a version that includes patched go-jose
2. Once available, rebuild the Caddy binary with the updated dependency
3. Remove the corresponding ignore rules from .grype.yaml

Acceptance Criteria

• Caddy binary includes go-jose/v3 >= v3.0.5 and go-jose/v4 >= v4.1.4
• Grype scan passes without ignore rules for GHSA-78h2-9frx-2jm8
• Ignore rules removed from .grype.yaml