make build-caddy: pin golang.org/x/net and scan the Caddy release asset #3579

Problem

make build-caddy builds the Caddy release asset (caddy-linux-amd64, with caddy-l4 and every DNS-01 provider) via xcaddy build $(CADDY_VERSION) with no --replace pin for golang.org/x/net. The three container images that build Caddy or other Go binaries from source all pin x/net with replace (now v0.62.0, fixing CVE-2026-78661 in golang.org/x/net/html).

The slides-agent image's Caddy links the vulnerable package (51 golang.org/x/net/html symbols in the v0.132.0 binary). The release asset is built from the same Caddy source but is not covered by the image scan, so nothing gates its x/net version. I have not yet checked whether this binary links x/net/html; that is the first step.

Proposal

1. Symbol-check the current release asset for golang.org/x/net/html and record its embedded x/net version.
2. Add the same --replace golang.org/x/net=golang.org/x/net@<fixed> to make build-caddy, keeping internal/app/caddy_types_makefile_test.go (which pins the Makefile against its map) green.
3. Scan the built asset with the pinned Trivy in the release build (rootfs/binary scan, same severity and --ignore-unfixed).

Acceptance

• The release asset embeds x/net >= the current fixed version.
• The release build scans the asset and fails on a fixed HIGH/CRITICAL finding.
• Build-fetch inventory (scripts/ci/build-fetches.allow) re-listed for the changed xcaddy build line.

Blocked by: none
Sprint: #3725
Part of #3725