Bump golang.org/x/net to v0.55.0 and align Go directive to 1.26 (OCP 4.19 CVE cleanup)

[baijum]

Summary

Fixes CVE-2026-27136 and CVE-2026-39821 for OCP Tools 4.19 by bumping golang.org/x/net from v0.48.0 to v0.55.0. Also aligns the go.mod go directive to the 1.26 line, matching the identical treatment applied to the release-3.15/release-3.17/release-3.19 branches for the other OCP Tools streams.

• golang.org/x/net/html XSS via HTML parsing bypass (CVE-2026-27136)
• golang.org/x/net/idna privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

As an unavoidable side effect of Go's minimum-version-selection, bumping x/net to v0.55.0 also raised several other golang.org/x/* modules to newer minimums declared by x/net's own go.mod (crypto, mod, sync, sys, term, text, tools). All are official Go modules; this is expected fallout, not an unrelated change.

Once this ships, and a RelEng buildroot tag-add lands (see linked ticket), it also clears the way to close CVE-2026-33811, CVE-2026-39820, and CVE-2026-42504 for this stream via the Go 1.26.4 toolchain.

Tracking: HELM-821

Test plan

• go build ./... succeeds
• Makefile's build target (CGO_ENABLED=0, -tags no_openssl) succeeds; built binary runs and reports v3.20.2
• CI build/test suite (pending, this PR)

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: baijum

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [baijum]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[baijum]

Build verification correction

go build ./... and the native make build target (CGO_ENABLED=0, -tags no_openssl) both succeed against this change, and the resulting binary runs correctly.

make build-cross could not be verified locally in this environment. It panics immediately, before compiling anything:

panic: fips140: unknown GODEBUG setting fips140=auto
goroutine 1 [running]:
crypto/internal/fips140.init.0()
	crypto/internal/fips140/fips140.go:27 +0x12c
make: *** [build-cross] Error 2

build-cross sets GODEBUG=fips140=auto, a Red Hat-patched Go (golang-fips/go) feature not recognized by vanilla upstream Go — the go tool itself panics at its own init when that env var is set, regardless of target GOOS/GOARCH.

Confirmed this is pre-existing and unrelated to this change: the identical panic occurs on a completely unmodified release-3.20 checkout with none of this PR's changes applied. Verifying build-cross requires the RH FIPS-patched Go toolchain, which isn't installed in this dev environment — CI/Brew (which uses the correct toolchain) is the right place to confirm cross-compilation still works.