CLSA-2026-1780993851 osbuild-composer: Fix of 2 CVEs

CVE-2026-32286: pgproto3 v2 DataRow.Decode panic on negative msgSize - CVE-2026-34986: go-jose v2 KeyUnwrap panic on too-short encryptedkey...