Add container HEALTHCHECK and bump vulnerable Go dependencies

[betterix]

Summary

• Add a HEALTHCHECK to the Docker images so docker ps / Compose / Swarm can report whether the tunnel is actually up.
• Bump Go dependencies flagged by Trivy that have upstream fixes.

Changes

Healthcheck

• Set TUNNEL_METRICS=0.0.0.0:2000 so the metrics server listens on a known port.
• Added:
  HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["cloudflared", "tunnel", "--metrics", "127.0.0.1:2000", "ready"]
• Uses the built-in ready command, so no shell or curl is needed in the distroless image.

Dependencies

• golang.org/x/crypto v0.53.0 -> (CVE-2026-56854, CVE-2026-56855, CVE-2026-78662)
• google.golang.org/grpc v1.83.1 -> (CVE-2026-84445)
• go.opentelemetry.io/otel/sdk v1.44.0 -> (CVE-2026-81870)
• go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 -> (CVE-2026-81870)

Testing

• Built the image and ran a quick tunnel: docker run -d cloudflared:test tunnel --url http://localhost:8080
• docker inspect --format '{{.State.Health.Status}}' reports starting, then healthy once connected.
• Re-ran trivy image: the fixed Go module findings are gone. The remaining libc6/zlib1g findings have no fixed version in the Debian base image.