fix(nancy): remediate nancy findings

Author: heraldbot[bot]

.nancy-ignore

@@ -1,2 +1,4 @@
-CVE-2026-41178 until=2026-08-27 # go.opentelemetry.io/otel@v1.43.0
-CVE-2026-63209 until=2026-08-29 # github.com/klauspost/compress@v1.18.0
+CVE-2026-56864 until=2026-10-02 # golang.org/x/mod@v0.37.0
+CVE-2026-56865 until=2026-10-02 # golang.org/x/mod@v0.37.0
+CVE-2026-56854 until=2026-10-02 # golang.org/x/crypto@v0.54.0
+CVE-2026-63209 until=2026-10-02 # github.com/klauspost/compress@v1.18.0

go.mod

@@ -98,7 +98,10 @@ replace github.com/sirupsen/logrus v1.9.0 => github.com/sirupsen/logrus v1.9.4
 
 replace github.com/yuin/goldmark v1.2.1 => github.com/yuin/goldmark v1.8.2
 
-replace go.opentelemetry.io/otel v1.20.0 => go.opentelemetry.io/otel v1.44.0
+replace (
+	go.opentelemetry.io/otel v1.20.0 => go.opentelemetry.io/otel v1.44.0
+	go.opentelemetry.io/otel v1.43.0 => go.opentelemetry.io/otel v1.46.0
+)
 
 replace go.opentelemetry.io/otel/sdk v1.20.0 => go.opentelemetry.io/otel/sdk v1.44.0
 
@@ -110,3 +113,5 @@ replace google.golang.org/grpc v1.59.0 => google.golang.org/grpc v1.81.1
 // compile against controller-runtime v0.24 / cluster-api v1.13 (moved api packages). This replace points
 // at a giantswarm fork that patches only those files. Keep until CAPVCD is replaced/removed as a dependency.
 replace github.com/vmware/cluster-api-provider-cloud-director => github.com/giantswarm/cluster-api-provider-cloud-director v1.3.3
+
+replace github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 => github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0