[Aikido] Fix security issue in x/net via minor version upgrade from 0.58.0 to 0.60.0

[aikido-autofix]

Upgrade golang.org/x/net to fix HTTP/2 vulnerabilities: excessive CPU consumption from SETTINGS frames, memory exhaustion via Trailer headers, response smuggling, server crashes from concurrent HPACK encoder access, and flow control bypass.

✅ 5 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-78669	HIGH	[golang.org/x/net] A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
CVE-2026-78659	HIGH	[golang.org/x/net] A malicious client can send HTTP/2 requests with "Trailer" headers declaring numerous fields, causing excessive memory allocation on the server and bypassing header size limits, resulting in denial of service.
CVE-2026-78660	HIGH	[golang.org/x/net] HTTP/2 implementation insufficiently validates framing headers, allowing malformed headers to be forwarded to HTTP/1 clients in reverse proxy scenarios, enabling response smuggling attacks.
CVE-2026-97032	MEDIUM	[golang.org/x/net] HTTP/2 servers crash due to unsynchronized concurrent access to the HPACK encoder when handling client requests and SETTINGS frames. A malicious client can exploit this by repeatedly sending requests while modifying the header table size, causing a denial of service.
CVE-2026-78663	MEDIUM	[golang.org/x/net] HTTP/2 server refunds connection-level flow control twice for the same data, allowing a malicious client to bypass the configured flow control limit. This enables potential denial-of-service attacks through excessive buffering.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 81ea567...5d68dc5 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Go		Oct 10, 2026 1:04a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.