chore(deps): bump golang.org/x/crypto to v0.52.0

[ratelle]

Clears the 14 x/crypto findings Aikido reports on this repo — the AIKIDO-2026-110xx group, all golang.org/x/crypto/ssh advisories fixed in 0.52.0.

The tradeoff, stated plainly

This raises the module's go directive 1.23.0 → 1.25.0, because that's what x/crypto v0.52.0 requires. The README's stated requirement moves to Go 1.25 in the same commit so the docs don't contradict the manifest.

v0.52.0 rather than latest is deliberate: v0.56.0+ declares go 1.26.0 and would push the floor another version for no additional fix here.

Impact on consumers, verified rather than assumed:

Consumer setup	Result
Default GOTOOLCHAIN	Unaffected — Go downloads 1.25 automatically
GOTOOLCHAIN=local on Go < 1.25	Breaks: go.mod requires go >= 1.25.0 (running go 1.24.3; GOTOOLCHAIN=local)

That second row is pinned CI, air-gapped builds, and distro packaging. This is a public module, so that's a real if narrow cost.

This is hygiene, not an exposure fix

Worth being explicit, so reviewers can weigh the above honestly:

• Nothing here imports x/crypto. It arrives indirectly via google.golang.org/api → s2a-go.
• The build graph contains only cryptobyte, chacha20, poly1305, hkdf — no ssh package, so none of the 14 advisories were reachable.
• Because x/crypto is indirect, the declared version is only an MVS floor, not a ceiling. Consumers already resolve higher on their own — optable-sandbox depends on this module and builds it at v0.57.0.

So the benefit is a clean scanner board and a smaller future bump, not a closed vulnerability. Reasonable to reject on the grounds that the Go floor matters more than the finding.

Verification

• go build ./... passes
• go vet ./protogen/... passes