chore(deps): update vulnerable Go modules

[appleboy]

Summary

• Upgrade vulnerable Go modules in the application and example module.
• The fixed versions remove the reported Trivy HIGH findings.

AI authorship

• AI was used
  • Tool / model: Codex (GPT-5)
  • AI-authored files: go.mod, go.sum, _example/go.mod, _example/go.sum
  • Human line-by-line reviewed: None — not yet reviewed by a human.

Change classification

• Leaf change

Verification

• Automated: go test ./...; golangci-lint run; Trivy 0.70.0 filesystem scan (0 HIGH/CRITICAL findings).
• Not run: N/A

Security check

• No secrets in the diff
• N/A - no external interface changed

Risk and rollback

• Risk: Dependency compatibility with Firebase and Google client packages.
• Rollback: Revert commits 82559b7 and a8c921c.

Reviewer guide

• Read carefully: module version constraints and example-module lockfile updates.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.