cos-extensions: upgrade go.opentelemetry.io/otel/sdk to v1.43.0 to fix CVE-2026-39883

Upgrade go.opentelemetry.io/otel/sdk dependency to v1.43.0 and re-vendor Go dependencies via `go mod vendor` to resolve CVE-2026-39883 in app-admin/extensions-manager.

Provenance:
- CVE-2026-39883: Go module go.opentelemetry.io/otel/sdk fixed in v1.43.0, fix commits 9276201a64b6 ("Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)"), 45977a4b9cf4 ("Release v1.43.0/v2.5.0/v0.68.0/v0.37.0/v0.23.0/v0.18.0/v0.16.0/v0.15.0 (#8769)") (https://github.com/advisories/GHSA-hfvc-g4fc-pqhx)

Build adjustments:
- go get go.opentelemetry.io/otel/sdk@v1.43.0
- go mod tidy && go mod vendor && go mod verify

BUG=b/579600502
TEST=go mod verify; go test -mod=vendor ./...; CGO_ENABLED=0 go build -mod=vendor ./...
RELEASE_NOTE=Fixed CVE-2026-39883 in cos-extensions.

cos-patch: security-high
Change-Id: Ia8802128f0028ca301459297a3aeb019808d760c
Reviewed-on: https://cos-review.googlesource.com/c/cos/cos-extensions/+/231908
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Chenglong Tang <chenglongtang@google.com>