STAC-25466 tidy the Go workspace manifests

[LouisParkin]

Applies inv tidy to the workspace. 256 files, all go.mod / go.sum — no source, no CI, no config.

Why

go.mod at the repo root already requires the newer versions; the 100+ workspace sub-modules were never re-tidied after the gRPC bump, so their manifests still pin the previous ones. The gate added in #447 (Go module tidiness (go.mod / go.sum)) fails on main today because of it.

The drift is entirely propagation of what the root module already declares:

module	sub-modules said	root already requires
golang.org/x/sys	v0.45.0	v0.46.0
golang.org/x/net	v0.55.0	v0.56.0
golang.org/x/sync	v0.20.0	v0.21.0
golang.org/x/text	v0.37.0	v0.39.0
golang.org/x/crypto	v0.52.0	v0.53.0
go.opentelemetry.io/otel*	v1.43.0	v1.44.0
google.golang.org/grpc	v1.80.0	v1.82.1

Nothing is being upgraded here. MVS across the workspace already resolves to the right-hand column at build time — this commit just records it in the manifests so check-mod-tidy agrees.

How the patch was generated

Not by hand and not locally. A throwaway job ran the repo's own _go_only_tidy inside the pinned godeps CI image and uploaded the resulting git diff as an artifact; that artifact is what is committed here. The job has been removed from the branch — the only thing left is the manifest change.

inv tidy dispatches to _bazel_tidy when bazel is on PATH (it is, in that image), which also regenerates BUILD.bazel/gazelle output and trips the repo's XDG_CACHE_HOME-in-CI guard. _go_only_tidy is the go work sync + per-module go mod tidy path that check-mod-tidy actually verifies, so that is what was called.

Validation

The real proof is this PR's own Go module tidiness (go.mod / go.sum) check — it re-runs inv check-mod-tidy against the committed tree, which is exactly the condition that fails on main.

Jira: STAC-25466