build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0 in the all-go-deps group

[dependabot]

Bumps the all-go-deps group with 1 update: golang.org/x/net.

Updates golang.org/x/net from 0.58.0 to 0.59.0

Commits

• 540d04c go.mod: update golang.org/x dependencies
• 20eef7f quic: clear fast-path receive buffer on stream reset
• c23af1b internal/http3: fix compilation error due to missed symbol name update
• eda109f internal/http3: send appropriate error codes in STOP_SENDING frames
• 12e0501 internal/http3: server header size limits
• d89285e quic: add Stream.StopSending, and rework stream/application errors
• d34deae quic: ensure Endpoint.Close waits for connection loops to exit
• 55577aa http2: use IDNA Lookup profile, not raw Punycode translation
• b22627e internal/http3: handle a nil TLSConfig in newQUICConfig
• 6e98b0d internal/http3: report endpoint creation errors from initEndpoint
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[FumingPower3925]

Pushed the waiver this bump needs.

x/net 0.59.0 deprecates http2.Server itself and its stream and window fields in favour of http.Server.HTTP2 and http.HTTP2Config. That turns eight staticcheck SA1019 findings red in the h2c test scaffold, which is why Lint failed here.

The scaffold cannot migrate. Every one of these servers exists to be handed to h2c.NewHandler, which takes an *http2.Server, and net/http exposes no replacement for prior-knowledge h2c. The import line already carries a waiver saying precisely that; this applies the same waiver where the deprecation now lands.

The four-field literal is collapsed onto one line, because a nolint directive suppresses only its own line while staticcheck reports one issue per deprecated field. Its explanatory comment moves above the statement so nothing is lost.

Controls, each injection asserted against the real source text before editing:

injected	result
remove one waiver	Lint reddens on exactly that line, SA1019 on MaxConcurrentStreams
re-split the collapsed literal, nolint on the closing brace	five SA1019 findings return, one per field

golangci-lint run ./... reports 0 issues, and go build, go vet and the full go test ./... are clean on 0.59.0.