pulumi-kubernetes-operator/1.16.0-r20: cve remediation (#72875)

pulumi-kubernetes-operator/1.16.0-r20: fix GHSA-j5w8-q4qc-rx2x
<!--ci-cve-scan:must-fix: GHSA-j5w8-q4qc-rx2x-->


Advisory data:
https://github.com/wolfi-dev/advisories/blob/main/pulumi-kubernetes-operator.advisories.yaml

---

### "Breadcrumbs" for this automated service

- **Source Code:** https://go/cve-remedy-automation-source
- **Logs:** https://go/cve-remedy-automation-logs
- **Docs:** _(not provided yet)_

Co-authored-by: octo-sts[bot] <[email protected]>

Author: octo-sts[bot]

pulumi-kubernetes-operator.yaml

@@ -1,7 +1,7 @@
 package:
   name: pulumi-kubernetes-operator
   version: 1.16.0
-  epoch: 20 # CVE-2025-61725
+  epoch: 21 # GHSA-j5w8-q4qc-rx2x
   description: A Kubernetes Operator that automates the deployment of Pulumi Stacks
   copyright:
     - license: Apache-2.0
@@ -21,17 +21,29 @@ pipeline:
       repository: https://github.com/pulumi/pulumi-kubernetes-operator.git
       tag: v${{package.version}}
 
+  - uses: go/bump
+    with:
+      deps: |-
+        golang.org/x/[email protected]
+      modroot: test/testdata/go-build
+
+  - uses: go/bump
+    with:
+      deps: |-
+        golang.org/x/[email protected]
+      modroot: deploy/deploy-operator-go
+
   - uses: go/bump
     with:
       deps: |-
         github.com/hashicorp/[email protected]
         github.com/go-git/go-git/[email protected]
         github.com/golang/[email protected]
         golang.org/x/[email protected]
-        golang.org/x/[email protected]
         github.com/golang-jwt/jwt/[email protected]
         golang.org/x/[email protected]
         github.com/cloudflare/[email protected]
+        golang.org/x/[email protected]
       replaces: github.com/whilp/git-urls=github.com/chainguard-dev/[email protected]
 
   - uses: go/build