flux-image-reflector-controller/0.34.0-r3: cve remediation (#47829)

flux-image-reflector-controller/0.34.0-r3: fix GHSA-mh63-6h87-95cp

Advisory data:
https://github.com/wolfi-dev/advisories/blob/main/flux-image-reflector-controller.advisories.yaml

---

### "Breadcrumbs" for this automated service

- **Source Code:** https://go/cve-remedy-automation-source
- **Logs:** https://go/cve-remedy-automation-logs
- **Docs:** _(not provided yet)_

---------

Signed-off-by: Vivian Rook <vivian.rook@chainguard.dev>
Co-authored-by: octo-sts[bot] <157150467+octo-sts@users.noreply.github.com>
Co-authored-by: Vivian Rook <vivian.rook@chainguard.dev>

Author: octo-sts[bot]

flux-image-reflector-controller.yaml

@@ -1,7 +1,7 @@
 package:
   name: flux-image-reflector-controller
   version: "0.34.0"
-  epoch: 3
+  epoch: 4
   description: GitOps Toolkit controller that scans container registries
   copyright:
     - license: Apache-2.0
@@ -27,6 +27,8 @@ pipeline:
         golang.org/x/oauth2@v0.27.0
         golang.org/x/crypto@v0.35.0
         golang.org/x/net@v0.36.0
+        github.com/golang-jwt/jwt/v4@v4.5.2
+        github.com/golang-jwt/jwt/v5@v5.2.2
 
   - uses: go/build
     with: