[Aikido] Fix security issue in x/net via minor version upgrade from 0.59.0 to 0.60.0 in lib

[aikido-autofix]

Upgrade golang.org/x/net to fix HTTP/2 vulnerabilities: excessive CPU consumption from SETTINGS frames, memory exhaustion via Trailer headers, response smuggling, server crashes from concurrent HPACK encoder access, and flow control bypass.

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-78669	HIGH	[golang.org/x/net] A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
CVE-2026-78659	HIGH	[golang.org/x/net] A malicious client can send HTTP/2 requests with "Trailer" headers declaring numerous fields, causing excessive memory allocation on the server and bypassing header size limits, resulting in denial of service.
CVE-2026-78660	HIGH	[golang.org/x/net] HTTP/2 implementation insufficiently validates framing headers, allowing malformed headers to be forwarded to HTTP/1 clients in reverse proxy scenarios, enabling response smuggling attacks.
CVE-2026-97032	MEDIUM	[golang.org/x/net] HTTP/2 servers crash due to unsynchronized concurrent access to the HPACK encoder when handling client requests and SETTINGS frames. A malicious client can exploit this by repeatedly sending requests while modifying the header table size, causing a denial of service.
CVE-2026-78663	MEDIUM	[golang.org/x/net] HTTP/2 server refunds connection-level flow control twice for the same data, allowing a malicious client to bypass the configured flow control limit. This enables potential denial-of-service attacks through excessive buffering.

🔗 Related Tasks

• https://aikido.atlassian.net/browse/AIK-20869