fix(deps): bump golang.org/x/net to v0.61.0 [security] (#414)

Bumps `golang.org/x/net` from v0.57.0 to v0.61.0 to fix five HTTP/2 vulnerabilities that govulncheck reports as reachable through client-go:

- GO-2026-6603: HTTP/2 server memory exhaustion due to Trailer headers
- GO-2026-6610: HTTP/2 transport accepts malformed framing-related headers
- GO-2026-6611: Excessive CPU consumption from repeated initial window changes
- GO-2026-6612: Double flow control refund on HTTP/2 server streams
- GO-2026-6617: HTTP/2 server crash due to HPACK encoder race

`go get` also brought in newer `x/sys`, `x/term` and `x/text`.

Verified locally: `govulncheck ./...` reports no vulnerabilities, and `go test -race ./...` passes (the repo has no test files).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01MFgbwhfAnf8tMbeKRab9AD
Reviewed-on: https://gitea.unbound.se/unboundsoftware/default-request-adder/pulls/414

go.mod

@@ -38,11 +38,11 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/net v0.61.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
+	golang.org/x/term v0.47.0 // indirect
+	golang.org/x/text v0.43.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect