Security update for mcphost

Open Source Vulnerabilities SUSE-SU-2026:21756-1

This update for mcphost fixes the following issues - CVE-2025-30153: github.com/getkin/kin-openapi/openapi3filter: Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter (bsc#1264762). - CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or (bsc#1265274). - CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1265275). - CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253952). - CVE-2026-32285: github.com/buger/jsonparser: denial of service via malformed JSON input (bsc#1264759). - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo- header (bsc#1260224). Changes for mcphost: - Updated to version 0.34.0 * Features: - Upgrade charmbracelet libs to v2 (bubbletea, lipgloss, bubbles) - Add Google Vertex AI support for Claude models - Add new models. * Fixes: - Eliminate escape sequence leak from spinner tea.Program instances. - Fix anthropic api issue. - Convert JSON Schema draft-07 exclusive bounds to draft-04 format. * Upgrade all dependencies to latest versions, resolve security issues and to obtain Go 1.26 compatibility.