cos-extensions: upgrade golang.org/x/crypto to v0.52.0 to fix CVE-2026-39832, CVE-2026-39831

Upgrade golang.org/x/crypto dependency to v0.52.0 and re-vendor Go dependencies via `go mod vendor` to resolve CVE-2026-39832, CVE-2026-39831 in app-admin/extensions-manager.

Provenance:
- CVE-2026-39832: Go module golang.org/x/crypto fixed in v0.52.0, fix commit go.dev/cl/778640 (https://github.com/advisories/GHSA-f5wc-c3c7-36mc)
- CVE-2026-39831: Go module golang.org/x/crypto fixed in v0.52.0, fix commit go.dev/cl/781662 (https://github.com/advisories/GHSA-89gr-r52h-f8rx)

Build adjustments:
- go get golang.org/x/crypto@v0.52.0
- go mod tidy && go mod vendor && go mod verify

BUG=b/575144497
BUG=b/575136101
TEST=go mod verify; go test -mod=vendor ./...; CGO_ENABLED=0 go build -mod=vendor ./...
RELEASE_NOTE=Fixed CVE-2026-39832, CVE-2026-39831 in cos-extensions.

cos-patch: security-high
Change-Id: I422f16d95496613bda010308cc54f44c4f8edf1c
Reviewed-on: https://cos-review.googlesource.com/c/cos/cos-extensions/+/227466
SLSA-Policy-Verified: SLSA Policy Verification Service <devtools-gerritcodereview-exitgate@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Chenglong Tang <chenglongtang@google.com>