build: raise golang.org/x/crypto to v0.56.0 at build time

The pinned upstream tag requires golang.org/x/crypto v0.53.0 as an indirect dependency, and three advisories against its ssh package affect that version: CVE-2026-56854 (fixed in v0.55.0), CVE-2026-78662 and CVE-2026-56855 (both fixed in v0.56.0). Upstream has not moved. This raises the module to v0.56.0 at build time.

The images are still chainguard-forks/kaniko at KANIKO_VERSION, and no upstream file is edited. go-overrides.txt is the only place the version is written; each builder stage applies it with go get, go mod tidy and go mod vendor, which upstream's vendored modules make necessary. Every image carries the list in its io.gitlab.public-sector.kaniko.go_overrides label, or none.

Proof: a local Dockerfile.debug build with the CI build args. go version -m on the extracted executor reports golang.org/x/crypto v0.56.0 and moby/go-archive v0.2.0 => v0.1.0, untouched. Trivy drops the x/crypto findings from 4 to 1, the remaining one being the unmaintained openpgp package, which has no fix at any version. CVE-2026-56854 is absent. The executor starts and builds a test image under GODEBUG=fips140=on.

scripts/check-versions.sh reads upstream's go.mod and fails once upstream requires the module at or above v0.56.0, so the override retires itself.

The release is a separate step: v1.25.19-1.