fix(deps): bump go-jose and OpenTelemetry to address security alerts

[merlimat]

Motivation

Several open Dependabot alerts affect Go module dependencies. This PR addresses the ones that have a published fix:

Alert	Severity	Dependency	Exposure
#47	high	github.com/go-jose/go-jose/v4	runtime (pulsar/auth via AthenZ)
#44	high	go.opentelemetry.io/otel/sdk	test-only (testcontainers → docker)
#49	high	go.opentelemetry.io/otel/sdk	test-only
#48	medium	.../otlptrace/otlptracehttp	test-only

Modifications

• Bump github.com/go-jose/go-jose/v4 4.0.5 → 4.1.4 (fixes the JWE decryption panic). This is the only runtime-impacting dependency here.
• Bump the OpenTelemetry modules to v1.43.0 (otel, otel/sdk, otel/metric, otel/trace, otel/exporters/otlp/otlptrace/otlptracehttp). These are only reachable from the test binary (testcontainers-go → docker/docker). The large transitive bumps they trigger (grpc, golang.org/x/net) stay on the test side; the runtime-facing transitive bumps are limited to minor/patch versions (protobuf, golang.org/x/oauth2, golang.org/x/crypto).
• go mod tidy additionally drops the already-unused github.com/99designs/keyring dependency tree.

The remaining github.com/docker/docker alerts (#45, #46, #50, #51, #52) are not addressed here: the latest published module (v28.5.2+incompatible) is still within their vulnerable ranges (the fixed v29.3.1 is not published as a Go module), and they are test-only.

Verifying this change

• Make sure that the change passes the CI checks.

This change is a dependency upgrade without code changes; covered by the existing build and tests.

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): yes (see above)
• The public API: no
• The schema: no
• The default values of configurations: no
• The wire protocol: no

Documentation

• Does this pull request introduce a new feature? no