chore(deps): consolidate dependency bumps

[nvanthao]

Consolidates the following open dependabot chore(deps) PRs into a single branch.

Once this PR is merged, dependabot will automatically close the superseded PRs below (#6058, #6057, #6056, #6055, #6054, #6042, #6041) on its next run, since their target dependencies will already be up to date on main.

Go modules (go get + go mod tidy)

• code.cloudfoundry.org/bytefmt 0.79.0 → 0.80.0 (chore(deps): bump code.cloudfoundry.org/bytefmt from 0.80.0 to 0.81.0 #6058)
• golang.org/x/text 0.38.0 → 0.40.0 (chore(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 #6057)
• golang.org/x/crypto 0.53.0 → 0.54.0 (chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 #6056)
• github.com/replicatedhq/troubleshoot 0.130.0 → 0.131.1 (chore(deps): bump github.com/replicatedhq/troubleshoot from 0.130.0 to 0.131.1 #6055)
• golang.org/x/sync 0.21.0 → 0.22.0 (chore(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 #6054)

The troubleshoot bump pulls in transitive updates (k8s.io/* → 0.36.2, grpc, helm, etc.) via normal MVS resolution.

npm (cherry-picked dependabot commits)

• @aws-sdk/client-s3 3.1058.0 → 3.1077.0 (chore(deps): bump @aws-sdk/client-s3 from 3.1058.0 to 3.1077.0 #6042)
• semver 7.8.1 → 7.8.5 (chore(deps): bump semver from 7.8.1 to 7.8.5 #6041)

Excluded

• sigs.k8s.io/controller-tools 0.20.1 → 0.21.0 (chore(deps): bump sigs.k8s.io/controller-tools from 0.20.1 to 0.21.0 #6017)
• sigs.k8s.io/controller-runtime 0.23.3 → 0.24.1 (chore(deps): bump sigs.k8s.io/controller-runtime from 0.23.3 to 0.24.1 #6016)

Verification

• GOOS=linux go build -tags "<buildtags>" ./cmd/... ./pkg/... ./kurl_util/... — passes
• go test -tags "<buildtags>" ./cmd/... ./pkg/... — all packages ok
• package-lock.json consistent with package.json for bumped npm packages