Bump golang.org/x/net to v0.57.0 (fixes reachable dnsmessage panic)

[kodareef5]

What & why

govulncheck reports GO-2026-5942: parsing an invalid SVCB or HTTPS DNS resource record can panic in golang.org/x/net/dns/dnsmessage. It is reachable from this code, not just present in the module graph, because the mDNS resolver unpacks untrusted response records:

Vulnerability #1: GO-2026-5942
    Parsing an invalid SVCB or HTTPS RR can panic in
    golang.org/x/net/dns/dnsmessage
    Found in: golang.org/x/net@v0.50.0
    Fixed in: golang.org/x/net@v0.56.0
    Example trace:
      internal/localdns/localdns.go:189:28: localdns.queryMDNS calls
      mdns.Server, which eventually calls dnsmessage.Message.Unpack

A hostile or malformed .local responder on the LAN can therefore panic the CLI during mDNS resolution.

The change

Bump golang.org/x/net to v0.57.0 (current; the fix landed in v0.56.0). go get carries the rest of the golang.org/x/* family to a consistent set (crypto, sys, term), the usual coupled release. go.mod + go.sum only.

Verification

Before and after, with govulncheck ./...:

• Before: GO-2026-5942 reported, reachable via localdns.go:189.
• After: GO-2026-5942 no longer reported.
• go build ./..., go vet ./..., and go test ./... all pass.

(govulncheck also flags GO-2026-5856 in the crypto/tls standard library, fixed in Go 1.25.12 / 1.26.5. That is a toolchain update, not a dependency change, and symbol reachability does not establish that this CLI actually negotiates ECH; out of scope for this PR.)

[kodareef5]

Thanks for merging this! I have a few additional potential security-related items that I’d prefer not to discuss publicly. Would you be willing to enable GitHub’s private vulnerability reporting for this repository? Alternatively, I’m happy to use another private contact method you prefer.

Once there’s a private channel, I can submit each finding separately with impact, reproduction steps, and proposed fixes.