deps: bump kcp-go to v5.6.73 (#5604)

Upgrade github.com/xtaci/kcp-go/v5 from v5.6.13 to v5.6.73. The
templexxx/cpu and templexxx/xorsimd indirect dependencies are no longer
required and are dropped from go.mod and go.sum. The go and toolchain
lines are unchanged and no other module changes.

This release carries the KCP-side fixes frp relies on: write backpressure
and duplicate fast-retransmit suppression, ACK and fast-retransmit flush
timing, the zero-window probe interval, and MTU accounting for FEC
overhead. The wire format is unchanged and frp interoperates with peers
on the old version in both directions.

kcp-go marks UDPSession.SetStreamMode as deprecated, but frp still needs
stream mode and there is no replacement. The calls stay as they are and a
staticcheck exclusion scoped to pkg/util/net/kcp.go is added to
.golangci.yml instead of //nolint comments. No code changes.

This is not a security fix: govulncheck reports the same result before and
after. Binary size with embedded web assets (CGO_ENABLED=0, -trimpath,
-ldflags "-s -w"): darwin/arm64 frpc 15,607,842 -> 15,591,282 (-16,560)
and frps 19,307,122 -> 19,290,434 (-16,688); linux/amd64 frpc
17,416,354 -> 17,449,122 (+32,768) and frps 21,274,786 -> 21,311,650
(+36,864).

Validation:

- go build ./...
- go test -count=1 ./... (all packages pass except the pre-existing
  test/e2e/compatibility failure, which needs explicit baseline binary
  flags and fails on a clean checkout as well)
- make e2e with the real binaries (263 specs: 261 passed, 2 skipped)
- repo-wide golangci-lint run: 2 SA1019 reports without the exclusion,
  0 issues with it
- govulncheck ./...: unchanged (11 reachable standard-library advisories,
  no kcp-go or xtaci entries)
- Manual KCP throughput check on linux/arm64 loopback (frpc <-> frps over
  transport.protocol=kcp with TLS, yamux and FEC 10/3): a single 256 MB
  transfer goes from 7.8 MB/s to about 153 MB/s and 8 x 16 MB concurrent
  transfers from 7.8 MB/s to about 470 MB/s with matching sha256, and old
  and new peers interoperate in both directions. The repository e2e suite
  has no KCP throughput assertions, so this is a one-off manual check.

.golangci.yml

@@ -81,6 +81,10 @@ linters:
     - linters:
       - unparam
       text: is always false
+    - linters:
+      - staticcheck
+      path: ^pkg/util/net/kcp\.go$
+      text: "SA1019: .*SetStreamMode"
     paths:
     - .*\.pb\.go
     - .*\.gen\.go

go.mod

@@ -26,7 +26,7 @@ require (
 	github.com/stretchr/testify v1.12.1
 	github.com/tidwall/gjson v1.20.0
 	github.com/vishvananda/netlink v1.3.1
-	github.com/xtaci/kcp-go/v5 v5.6.13
+	github.com/xtaci/kcp-go/v5 v5.6.73
 	golang.org/x/crypto v0.58.0
 	golang.org/x/net v0.62.0
 	golang.org/x/oauth2 v0.37.0
@@ -57,8 +57,6 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/procfs v0.22.0 // indirect
-	github.com/templexxx/cpu v0.1.1 // indirect
-	github.com/templexxx/xorsimd v0.4.3 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tjfoc/gmsm v1.4.1 // indirect

go.sum

@@ -142,10 +142,6 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
 github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
-github.com/templexxx/cpu v0.1.1 h1:isxHaxBXpYFWnk2DReuKkigaZyrjs2+9ypIdGP4h+HI=
-github.com/templexxx/cpu v0.1.1/go.mod h1:w7Tb+7qgcAlIyX4NhLuDKt78AHA5SzPmq0Wj6HiEnnk=
-github.com/templexxx/xorsimd v0.4.3 h1:9AQTFHd7Bhk3dIT7Al2XeBX5DWOvsUPZCuhyAtNbHjU=
-github.com/templexxx/xorsimd v0.4.3/go.mod h1:oZQcD6RFDisW2Am58dSAGwwL6rHjbzrlu25VDqfWkQg=
 github.com/tidwall/gjson v1.20.0 h1:+agJ3rEzKcCXKDKo0ml26UROcpcAlnZyjq+TjbY5Fto=
 github.com/tidwall/gjson v1.20.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
@@ -160,8 +156,8 @@ github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW
 github.com/vishvananda/netlink v1.3.1/go.mod h1:ARtKouGSTGchR8aMwmkzC0qiNPrrWO5JS/XMVl45+b4=
 github.com/vishvananda/netns v0.0.5 h1:DfiHV+j8bA32MFM7bfEunvT8IAqQ/NzSJHtcmW5zdEY=
 github.com/vishvananda/netns v0.0.5/go.mod h1:SpkAiCQRtJ6TvvxPnOSyH3BMl6unz3xZlaprSwhNNJM=
-github.com/xtaci/kcp-go/v5 v5.6.13 h1:FEjtz9+D4p8t2x4WjciGt/jsIuhlWjjgPCCWjrVR4Hk=
-github.com/xtaci/kcp-go/v5 v5.6.13/go.mod h1:75S1AKYYzNUSXIv30h+jPKJYZUwqpfvLshu63nCNSOM=
+github.com/xtaci/kcp-go/v5 v5.6.73 h1:Ejk1O0GyjaEQOxTeZUn0jIss0jkk2BJU8VOeJKdOh+Y=
+github.com/xtaci/kcp-go/v5 v5.6.73/go.mod h1:FRqA8EUPgnBlP4UcXlcCWZ9if7XaqmZMfXOTynYEmc4=
 github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37 h1:EWU6Pktpas0n8lLQwDsRyZfmkPeRbdgPtW609es+/9E=
 github.com/xtaci/lossyconn v0.0.0-20200209145036-adba10fffc37/go.mod h1:HpMP7DB2CyokmAh4lp0EQnnWhmycP/TvwBGzvuie+H0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=