chore: upgrade dependencies (quic-go v0.61.0, compress v1.19.1, digest v1.2.0)

[imroc]

Dependency Upgrades

This PR upgrades 3 direct dependencies. Supersedes PR #511 (which was missing the icholy/digest upgrade).

Module	Old Version	New Version	Change
github.com/quic-go/quic-go	v0.60.0	v0.61.0	minor (sensitive)
github.com/klauspost/compress	v1.19.0	v1.19.1	patch
github.com/icholy/digest	v1.1.0	v1.2.0	minor

Sensitive dependency verification

quic-go v0.61.0 was upgraded and verified individually before upgrading the rest. Despite quic-go being vendored/modified in internal/http3/ (synced to v0.60.0), the build and all tests pass — the go.mod dependency upgrade is compatible with the existing modified internal/http3/ code.

Unchanged dependencies

The following sensitive dependencies were already at the latest version:

• github.com/refraction-networking/utls v1.8.2
• golang.org/x/net v0.57.0
• golang.org/x/crypto v0.54.0
• golang.org/x/text v0.40.0
• golang.org/x/sys v0.47.0

Verification

• go build ./... passes
• go vet ./... passes
• go test ./... passes (all packages OK, including internal/http2 and internal/http3)
• go mod tidy — no residual changes
• Only go.mod and go.sum modified — no source code changes

Note on modified upstream code

This PR only upgrades go.mod/go.sum dependencies. The manually synced upstream code in internal/http3/ (modified quic-go) and internal/http2/ (modified golang.org/x/net/http2) are not touched. Upstream sync of modified code is a separate manual process.

[imroc]

Automated review (PR Review Loop):

Scope: go.mod / go.sum only — no source files touched.

• quic-go v0.60.0 → v0.61.0 (minor, sensitive)
• klauspost/compress v1.19.0 → v1.19.1 (patch)
• icholy/digest v1.1.0 → v1.2.0 (minor)

Verification:

• CI passes on both Go 1.25.x and 1.26.x.
• quic-go v0.61.0 was previously validated against the vendored internal/http3/ in the dependency upgrade loop (build + vet + test all green, including internal/http2 and internal/http3 packages).
• No changes to internal/http3/, internal/http2/, or modified stdlib files.

Note: This PR supersedes #511 (which contains the quic-go and compress upgrades without digest). #511 can be closed once this merges.

No blockers. Self-approve limitation noted (author is repo owner).