minimal cve fixes x/net and k8s.io/kubernetes for 3.28

[paulgmiller]

Description

Currently 3 cves in calico 3.28.3 according to trivy

trivy  i --ignore-unfixed  mcr.microsoft.com/oss/calico/node:v3.28.3     

Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 0, CRITICAL: 0)

┌───────────────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────────┬───────────────────────────────────────────────────────────┐
│      Library      │ Vulnerability  │ Severity │ Status │ Installed Version │          Fixed Version           │                           Title                           │
├───────────────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ golang.org/x/net  │ CVE-2025-22870 │ MEDIUM   │ fixed  │ v0.35.0           │ 0.36.0                           │ golang.org/x/net/http/httpproxy: golang.org/x/net/proxy:  │
│                   │                │          │        │                   │                                  │ HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net │
│                   │                │          │        │                   │                                  │ https://avd.aquasec.com/nvd/cve-2025-22870                │
├───────────────────┼────────────────┤          │        ├───────────────────┼──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│ k8s.io/kubernetes │ CVE-2024-9042  │          │        │ v1.28.15          │ 1.29.13, 1.30.9, 1.31.5, 1.32.1  │ kubelet: Command Injection affecting Windows nodes via    │
│                   │                │          │        │                   │                                  │ nodes/*/logs/query API                                    │
│                   │                │          │        │                   │                                  │ https://avd.aquasec.com/nvd/cve-2024-9042                 │
│                   ├────────────────┤          │        │                   ├──────────────────────────────────┼───────────────────────────────────────────────────────────┤
│                   │ CVE-2025-0426  │          │        │                   │ 1.32.2, 1.31.6, 1.30.10, 1.29.14 │ k8s.io/kubernetes: kubelet: node denial of service via    │
│                   │                │          │        │                   │                                  │ kubelet checkpoint API                                    │
│                   │                │          │        │                   │                                  │ https://avd.aquasec.com/nvd/cve-2025-0426                 │
└───────────────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────────┴───────────────────────────────────────────────────────────┘
``

## Related issues/PRs

#9981 


## Todos

- [ ] Tests
- [ ] Documentation
- [ ] Release note

## Release Note

Move x/net to 0.36 and k8s.io/kubernetes from 1.28.15->1.29.14


## Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one `docs-*` label.

- `docs-pr-required`: This change requires a change to the documentation that has not been completed yet.
- `docs-completed`: This change has all necessary documentation completed.
- `docs-not-required`: This change has no user-facing impact and requires no docs.

Every PR needs one `release-note-*` label.

- `release-note-required`: This PR has user-facing changes. Most PRs should have this label.
- `release-note-not-required`: This PR has no user-facing changes.

Other optional labels:

- `cherry-pick-candidate`: This PR should be cherry-picked to an earlier release. For bug fixes only.
- `needs-operator-pr`: This PR is related to install and requires a corresponding change to the operator.

[matthewdupre]

/sem-approve

[hjiawei]

Error: go [list -e -json -compiled=true -test=false -export=false -deps=true -find=false -tags ignore_autogenerated -- ./lib/apis/...]: exit status 1: go: ../go.mod requires go >= 1.23.0 (running go 1.22.12; GOTOOLCHAIN=local)

v3.28 branch is currently built by golang 1.22 (included in calico/go-build v0.91). x/crypto v0.35+ requires golang 1.23 to build. We need to update this branch to golang 1.23 before incorporating the CVE fixes.

[hjiawei]

It would be best to keep this dependency in the Kubernetes v1.28 release to avoid any potential compatibility issues with older v0.28.15 k8s libraries.