chore(deps): routine updates — protobuf, cobra, gopher-lua-libs

[arun-k-bharathan]

Summary

Consolidated replacement for three stale Dependabot PRs, none of which carries a security fix:

• google.golang.org/protobuf 1.36.9 → 1.36.11
• github.com/spf13/cobra 1.10.1 → 1.10.2
• github.com/vadv/gopher-lua-libs 0.7.0 → 0.8.0

The diff is three requirement lines in go.mod and six in go.sum. No source or test files changed.

govulncheck ./... reports the same 14 reachable vulnerabilities here as on main, which is what you would expect: nothing in this PR is a security bump. #125 and #126 cover those.

gopher-lua-libs is the largest jump of the three, a minor version against two patches. It reaches this codebase through a single call, gopher_lua_libs.Preload(ls) at internal/lua/lua.go:257, which registers the library's modules into each worker's LState. The Docker-backed internal/lua tests exercise that path and pass.

Relationship to the other dependency PRs

#125 bumps grpc to 1.82.1, and grpc@v1.82.1/go.mod requires protobuf v1.36.11, the same version this PR sets directly. If #125 merges first, the protobuf line here becomes a no-op. If this merges first, it stands on its own. Either way MVS lands on 1.36.11, since both are the same module path.

Merge order across the cleanup: #125, then #126, then this one, then #128. Nothing here constrains the order, so it can go whenever convenient.

Supersedes

• chore(deps): Bump google.golang.org/protobuf from 1.36.9 to 1.36.11 #113: protobuf 1.36.9 → 1.36.11
• chore(deps): Bump github.com/spf13/cobra from 1.10.1 to 1.10.2 #117: cobra 1.10.1 → 1.10.2
• chore(deps): Bump github.com/vadv/gopher-lua-libs from 0.7.0 to 0.8.0 #116: gopher-lua-libs 0.7.0 → 0.8.0

All three are still open. Please close them after merging this one, since I'm working from a fork and can't close them myself.

Test plan

• go build ./...
• make test (go test -count=1 -race ./...), all 13 test packages pass, including the Docker-backed ones for cql, lua, psql, mongo and kafka
• make lint matches the main baseline at 238 findings, none new
• CI on this PR