cos-extensions: upgrade Go dependencies to fix CVE-2026-29181, CVE-2026-84304

Upgrade Go module dependencies (go.opentelemetry.io/otel@v1.41.0, google.golang.org/grpc@v1.83.1) and re-vendor via `go mod vendor` to resolve CVE-2026-29181, CVE-2026-84304 in app-admin/extensions-manager.

Provenance:
- CVE-2026-29181: Go module go.opentelemetry.io/otel fixed in v1.41.0, fix commits 4575a9774dd9 ("Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)"), 07fa42463ccd ("Release 1.41.0/2.3.0/0.66.0/0.35.0/0.21.0/0.16.0/0.14.0/0.13.0 (#8617)"), aa1894e09e3f ("Comply with W3C Baggage specification limits (#7880)") (https://github.com/advisories/GHSA-mh2q-q3fh-2475)
- CVE-2026-84304: Go module google.golang.org/grpc fixed in v1.83.1, fix commits 7354d9c8debb ("transport: restrict memory overhead of buffering small data frames (#9331)"), 8cfeca0e1ee5 ("Cherry-pick #9331 to v1.83.x (#9333)"), 1550d9e0cddb ("Change version to 1.83.1 (#9336)") (https://github.com/advisories/GHSA-vp52-pcj8-j9qc)

Build adjustments:
- go get go.opentelemetry.io/otel@v1.41.0
- go get google.golang.org/grpc@v1.83.1
- go mod tidy && go mod vendor && go mod verify

BUG=b/579594647, b/579585226
TEST=go mod verify; go test -mod=vendor ./...; CGO_ENABLED=0 go build -mod=vendor ./...
RELEASE_NOTE=Fixed CVE-2026-29181, CVE-2026-84304 in cos-extensions.

cos-patch: security-high
Change-Id: I38c874f4c2f4e6bdeef0c710aa42c965a318b6ff
Reviewed-on: https://cos-review.googlesource.com/c/cos/cos-extensions/+/231947
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
SLSA-Policy-Verified: SLSA Policy Verification Service <devtools-gerritcodereview-exitgate@google.com>
Reviewed-by: Chenglong Tang <chenglongtang@google.com>