chore: bump grpc and x/net for GO-2026-6061 and GO-2026-4918

[lakhansamani]

govulncheck reported 6 vulnerabilities your code calls here — not just requires. Two were fixable by bumping:

ID	Module	Was	Fixed in
GO-2026-6061	google.golang.org/grpc	v1.81.1	v1.82.1
GO-2026-4918	golang.org/x/net	v0.51.0	v0.53.0

After the bump, govulncheck ./... reports no module-level called vulnerabilities. The 4 remaining called findings are all Go standard library (crypto/tls, crypto/x509, net/textproto, net, net/http) and are fixed by building with Go >= 1.26.5; they cannot be resolved from go.mod, since a library inherits the consumer toolchain. Scan was run on go1.26.2 locally.

Verification

Ran the full integration suite against a live server built from authorizer@main, across all three transports (graphql / rest / grpc):

ARM A (bumped deps):   0 failures
ARM B (original deps): 0 failures
ARM A again (bumped):  0 failures

Worth recording for whoever runs these next: the suite fails wholesale against a default-configured server, and neither failure is the SDK.

• --disable-mfa=true is required, or Login returns a TOTP challenge with a nil AccessToken instead of a token
• --rate-limit-rps=0 is required, or the run trips rate_limit_exceeded partway and every later test fails its signup prerequisite

Without those two flags the results flip depending on run order, which is what made the first comparison look like the bump had changed behaviour. It had not.