[release-3.5] Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3

[ivanvc]

After opening #22365 and running a govulncheck scan in this branch, it also failed. Bumped github.com/gorilla/websocket from v1.4.2 to v1.5.3 to address the failure.

...
=== Symbol Results ===

Vulnerability #1: GO-2026-6278
    Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key in
    github.com/gorilla/websocket
  More info: https://pkg.go.dev/vuln/GO-2026-6278
  Module: github.com/gorilla/websocket
    Found in: github.com/gorilla/websocket@v1.4.2
    Fixed in: github.com/gorilla/websocket@v1.5.3
    Example traces found:
      #1: embed/serve.go:469:18: embed.accessController.ServeHTTP calls http.ServeMux.ServeHTTP, which eventually calls websocket.Conn.Close
      #2: embed/serve.go:469:18: embed.accessController.ServeHTTP calls http.ServeMux.ServeHTTP, which eventually calls websocket.Conn.ReadMessage
      #3: embed/serve.go:469:18: embed.accessController.ServeHTTP calls http.ServeMux.ServeHTTP, which eventually calls websocket.Conn.WriteMessage
      #4: embed/serve.go:469:18: embed.accessController.ServeHTTP calls http.ServeMux.ServeHTTP, which eventually calls websocket.Upgrader.Upgrade
      #5: lease/leasehttp/http.go:63:22: leasehttp.leaseHandler.ServeHTTP calls io.ReadAll, which calls websocket.flateReadWrapper.Read
      #6: lease/leasehttp/http.go:63:22: leasehttp.leaseHandler.ServeHTTP calls io.ReadAll, which calls websocket.messageReader.Read
      #7: embed/serve.go:519:16: embed.corsHandler.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls websocket.truncWriter.Write

=== Package Results ===

No other vulnerabilities found.

=== Module Results ===

Vulnerability #1: GO-2026-6303
    Source-address critical option not enforced for non-public-key auth
    callbacks in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6303
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.53.0
    Fixed in: golang.org/x/crypto@v0.55.0

Vulnerability #2: GO-2026-5932
    The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design,
    and has known security issues
  More info: https://pkg.go.dev/vuln/GO-2026-5932
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.53.0
    Fixed in: N/A

Your code is affected by 1 vulnerability from 1 module.
This scan also found 0 vulnerabilities in packages you import and 2
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
FAIL: (code:3):
  % (cd server && 'govulncheck' '-show' 'verbose' './...')
FAIL: 'govuln' failed at Mon Aug 31 03:11:26 PM PDT 2026

Addresses GHSA-w67g-5rqw-f597 / GO-2026-6278.

[ivanvc]

/retest

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fuweid, ivanvc
Once this PR has been reviewed and has the lgtm label, please assign ahrtr for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment