fix(deps): remove vulnerable chi v4 middleware dependency (#2651)

# Description

`pkg/server` and `pkg/log` imported the chi v4 `middleware` package
while `go.mod` already requires `chi/v5` for the router — a
mixed-version leftover. The v4 line carries `GO-2026-4316` (open
redirect in `RedirectSlashes`) with no fixed v4 release, and govulncheck
flags it as reachable.

This migrates both imports to `github.com/go-chi/chi/v5/middleware` and
drops the v4 module from `go.mod`/`go.sum`. The v5 `middleware` API is
drop-in for everything used.

## Related Issue

Code-scanning alert 808 (govulncheck, `GO-2026-4316`), raised by the
scanner added in #2643.

## Checklist

- [ ] I have read the [contributing
documentation](https://retina.sh/docs/Contributing/overview).
- [ ] I signed and signed-off the commits (`git commit -S -s ...`). See
[this
documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification)
on signing commits.
- [x] I have correctly attributed the author(s) of the code.
- [x] I have tested the changes locally.
- [x] I have followed the project's style guidelines.
- [ ] I have updated the documentation, if necessary.
- [ ] I have added tests, if applicable.

## Screenshots (if applicable) or Testing Completed

Verified on the PR head: no `go-chi/chi` v4 reference remains anywhere
in the repo, and `go build` and `go vet` pass for `pkg/server` and
`pkg/log`. govulncheck at the builder toolchain (`go1.26.5`) confirms
`GO-2026-4316` no longer appears.

## Additional Notes

The govulncheck legs on this PR will still be red with 11 findings —
that is unrelated to this change. Go 1.26.6 shipped stdlib security
fixes on 2026-08-13 and the builder images are on `1.26.5`, so seven new
stdlib findings apply repo-wide until the `golang-base` image bump. This
PR's delta is exactly the removal of `GO-2026-4316`.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: nddq <28567936+nddq@users.noreply.github.com>

Author: Copilot

go.mod

@@ -182,7 +182,6 @@ require (
 )
 
 require (
-	github.com/go-chi/chi v4.1.2+incompatible
 	github.com/go-logr/logr v1.4.4
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect

go.sum

@@ -408,8 +408,6 @@ github.com/gkampitakis/go-diff v1.3.2 h1:Qyn0J9XJSDTgnsgHRdz9Zp24RaJeKMUHg2+PDZZ
 github.com/gkampitakis/go-diff v1.3.2/go.mod h1:LLgOrpqleQe26cte8s36HTWcTmMEur6OPYerdAAS9tk=
 github.com/gkampitakis/go-snaps v0.5.15 h1:amyJrvM1D33cPHwVrjo9jQxX8g/7E2wYdZ+01KS3zGE=
 github.com/gkampitakis/go-snaps v0.5.15/go.mod h1:HNpx/9GoKisdhw9AFOBT1N7DBs9DiHo/hGheFGBZ+mc=
-github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec=
-github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
 github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
 github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-critic/go-critic v0.14.3 h1:5R1qH2iFeo4I/RJU8vTezdqs08Egi4u5p6vOESA0pog=

pkg/log/zap.go

@@ -13,7 +13,7 @@ import (
 	"time"
 
 	"github.com/Azure/azure-container-networking/zapai"
-	"github.com/go-chi/chi/middleware"
+	"github.com/go-chi/chi/v5/middleware"
 	"github.com/go-logr/logr"
 	"github.com/go-logr/zapr"
 	logfmt "github.com/jsternberg/zap-logfmt"

pkg/server/server.go

@@ -8,8 +8,8 @@ import (
 	"net/http/pprof"
 	"time"
 
-	"github.com/go-chi/chi/middleware"
 	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
 	"github.com/microsoft/retina/pkg/exporter"
 	"github.com/microsoft/retina/pkg/log"
 	"github.com/pkg/errors"