fix(security): go security fixes (2026-05-25)

[github-actions]

Summary

Batch Go security fixes for moderate+ Dependabot alerts with available resolvable versions.

Included fixes

• CVE-2026-46680 (high): containerd user ID handling bypass allows runAsNonRoot evasion — github.com/containerd/containerd/v2 2.2.2 -> 2.2.4

Risks

• No major version bumps in the applied fix.
• github.com/docker/docker alerts were not included in this PR: Dependabot provided 29.3.1, but github.com/docker/docker@v29.3.1 is not a published Go module revision (latest available series in module proxy is v28.x +incompatible).
• Alerts with fixed_version: null were skipped.