SUSE-SU-2026:23736-1

This update for google-guest-agent fixes the following issues:

• CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
• CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
• CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279297).
• CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279414).
• CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278967).

Changes for google-guest-agent:

• Update to version 20260903.01

• Update dependencies to latest (#636)
• fix octal digit comparison in morePermissive (#631)
• Remove KillMode from google-guest-agent-manager (#629)
• Fix SUSE Linux Micro 6+ (#628)

• Fix oslogin for Micro 6+

• Exclude irrelevant tests on FreeBSD (#625)
• Replace abandoned serial dependency (#624)
• Add build rules for MWLID extension
• Support basic account management on FreeBSD (#619)
• fix dependency between sshd and google-guest-agent-manager.service (#621)
• Update go.mod dependencies (#622)
• Fallback to shebang execution when running scripts (#618)
• Update go dependencies (#620)
• Make guest-agent buildable on FreeBSD (#617)