fix: bump Go and x deps for CVE fixes (#49743)

## Summary
- Go 1.25.9 -> 1.25.10 and builder Dockerfiles now use Go 1.25.10. This
covers CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39823,
CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499.
- golang.org/x/crypto -> v0.52.0 across root/pkg/client/tests_go_client.
This covers CVE-2026-39829, CVE-2026-39830, CVE-2026-39831,
CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-42508,
CVE-2026-46595, CVE-2026-46597.
- golang.org/x/net -> v0.55.0 across root/pkg/client/tests_go_client.
This covers CVE-2026-33814 and CVE-2026-39821.
- github.com/apache/thrift v0.20.0 -> v0.23.0, including
tests_go_client. This covers CVE-2026-41602.
- Updated tests/go_client/go.mod and go.sum so Go SDK CI has the
required x/* sum entries.

This PR is generated by the automated CVE fix task.

issue: https://github.com/milvus-io/milvus/issues/49032

## Test plan
- go mod tidy in pkg/
- go mod tidy in client/
- go mod tidy in tests/go_client/
- go mod tidy -e at repository root (standard tidy is blocked by
existing missing generated package cmd/tools/migration/legacy/legacypb)
- git diff --check
- go list -tags L0,L1,L2,test ./... in tests/go_client
- go list -m for updated dependencies in root/pkg/client/tests_go_client
- CI validates image build, Go SDK e2e, and scan

---------

Signed-off-by: Li Liu <[email protected]>
Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

.env

@@ -5,11 +5,11 @@ IMAGE_ARCH=amd64
 OS_NAME=ubuntu22.04
 
 # for services.builder.image in docker-compose.yml
-DATE_VERSION=20260525-c5b2f49
-LATEST_DATE_VERSION=20260525-c5b2f49
+DATE_VERSION=20260604-a4e4949
+LATEST_DATE_VERSION=20260604-a4e4949
 # for services.gpubuilder.image in docker-compose.yml
-GPU_DATE_VERSION=20260525-c5b2f49
-LATEST_GPU_DATE_VERSION=20260525-c5b2f49
+GPU_DATE_VERSION=20260604-a4e4949
+LATEST_GPU_DATE_VERSION=20260604-a4e4949
 
 # for other services in docker-compose.yml
 MINIO_ADDRESS=minio:9000