fix: bump golang.org/x/crypto to v0.55.0 (CVE-2026-56854) for a 1.12.8 release

[tebulrich]

Summary

• Published v1.12.7 images still vendor golang.org/x/crypto v0.54.0, which is CVE-2026-56854 (golang.org/x/crypto/ssh source-address bypass). The fix is v0.55.0.
• This branch is based on v1.12.7, not current main. main already has v0.55.0 via chore: bump the go-modules group across 1 directory with 2 updates #2624 (and Go 1.27). Please do not merge this branch into main as-is.
• Intended use: tag this commit as v1.12.8 (or cherry-pick the last commit onto a 1.12 release line) so dunglas/frankenphp:1.12* rebuilds pick up the patched modules.
• Also bumps github.com/getkin/kin-openapi v0.140.0 → v0.144.0 (CVE-2026-73501).

Reviewable diff vs the last release: v1.12.7...tebulrich:frankenphp:fix/cve-2026-56854-x-crypto

Test plan

• go list -m golang.org/x/crypto is v0.55.0 in the root module and caddy/
• go list -m github.com/getkin/kin-openapi is v0.144.0 in caddy/
• Rebuild the 1.12 Docker images from this tag and confirm go version -m on /usr/local/bin/frankenphp shows golang.org/x/crypto v0.55.0
• Image CVE scan no longer reports CVE-2026-56854 or CVE-2026-73501 in usr/local/bin/frankenphp

[alexandre-daubois]

I don't get the purpose of this PR. Libs are up to date on main and ready for the next release.