chore/security: update deps for CVEs reported by trivy

[burmudar]

Ran trivy:

• upgrade otel
• upgrade pgx
• upgrade tar used by npm-distribution

Test plan

2026-05-08T13:26:57.709+0200    INFO    Vulnerability scanning is enabled
2026-05-08T13:26:57.709+0200    INFO    Secret scanning is enabled
2026-05-08T13:26:57.709+0200    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-05-08T13:26:57.709+0200    INFO    Please see also https://aquasecurity.github.io/trivy/v0.47/docs/scanner/secret/#recommendation for faster secret detection
2026-05-08T13:26:58.119+0200    WARN    Unable to collect additional info: dependency graph error: /Users/william/go/pkg/mod/k8s.io/apimachinery@v0.33.2/go.mod parse error: go.mod parse error: go.mod:7: unknown directive: godebug
2026-05-08T13:26:58.130+0200    INFO    Number of language-specific files: 3
2026-05-08T13:26:58.130+0200    INFO    Detecting gomod vulnerabilities...
2026-05-08T13:26:58.132+0200    INFO    Detecting npm vulnerabilities...

[keegancsmith]

did you run go mod tidy?