chore: bump deps

[dunglas]

Update Go module deps in root and caddy/.

Root

• kin-openapi 0.138.0 → 0.142.0
• golang.org/x/crypto 0.51 → 0.54, net 0.54 → 0.57, text 0.37 → 0.40
• httpsnoop 1.0.4 → 1.1.0, jsonpointer 0.23.1 → 1.0.0, oasdiff/yaml 0.0.9 → 0.1.1
• kin-openapi refactor pruned indirect deps (easyjson, mohae/deepcopy, marshmallow, decimal128, swag/jsonname)

caddy/

• Same kin-openapi + golang.org/x bumps, plus sys 0.44 → 0.47, mod 0.36 → 0.37, sync 0.20 → 0.22, term 0.43 → 0.45, tools 0.45 → 0.47

Build + tests pass. Pre-existing H2Push failures (missing test-push/vendor/, needs composer install) are unrelated to this bump.