cos-extensions: upgrade github.com/go-jose/go-jose/v4 to v4.1.6 to fix CVE-2026-116587

Upgrade github.com/go-jose/go-jose/v4 dependency to v4.1.6 and re-vendor Go dependencies via `go mod vendor` to resolve CVE-2026-116587 in app-admin/extensions-manager.

Provenance:
- CVE-2026-116587: Go module github.com/go-jose/go-jose/v4 fixed in v4.1.6, fix commit a0111f82742f ("Merge commit from fork") (https://github.com/advisories/GHSA-mgcc-cww5-fp2q)

Build adjustments:
- go get github.com/go-jose/go-jose/v4@v4.1.6
- go mod tidy && go mod vendor && go mod verify

BUG=b/581548629
TEST=go mod verify; go test -mod=vendor ./...; CGO_ENABLED=0 go build -mod=vendor ./...
RELEASE_NOTE=Fixed CVE-2026-116587 in cos-extensions.

cos-patch: security-high
Change-Id: Ic5ae892a9712a4a993c4bc571b62ed294095889b
Reviewed-on: https://cos-review.googlesource.com/c/cos/cos-extensions/+/233730
AI-Review: cloud-image-release <cloud-image-release@prod.google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Kevin Liu <zhihuil@google.com>