[Aikido] Fix 2 security issues in moby/go-archive, x/image

[aikido-autofix]

Upgrade go-archive and golang.org/x/image to fix path traversal via symlink/hardlink escape and VP8L memory exhaustion DoS vulnerabilities.

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-139363	HIGH	[github.com/moby/go-archive] Path traversal vulnerability in archive extraction functions allows crafted symlinks and hardlinks to escape the intended extraction directory through lexical path comparison instead of resolved path validation, enabling arbitrary file creation or overwriting.
CVE-2026-46603	HIGH	[golang.org/x/image] VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

[deepsource-io]

DeepSource Code Review

We reviewed changes in eec11ce...a07f226 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Go		Aug 16, 2026 1:34a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.