CP-47363: Upgrade prometheus-config-reloader to v0.93.1

[evan-cz]

Stacked on #1003.

Brings the bundled config reloader up two minor versions (v0.91.0 → v0.93.1), picking up upstream's own dependency work and clearing the four high-severity findings blocking the image scan: three in golang.org/x/crypto, one in go.etcd.io/etcd/client/pkg/v3.

This binary is built from upstream prometheus-operator source, so its dependency versions are upstream's, not ours. The build carries go get overrides for the ones upstream hasn't caught up on — and those name exact versions, so each goes stale as new advisories land against the version it names. That had already happened: the override named x/crypto v0.53.0, which has since had all three advisories filed against it, so the line written to clear findings had become the reason for them.

Upgrading lets two of the four overrides go:

	upstream at v0.93.1	outcome
x/net	v0.57.0	override dropped — ahead of the old pin, keeping it downgrades
x/text	v0.40.0	override dropped — ahead of the old pin, keeping it downgrades
x/crypto	v0.54.0	override kept at v0.56.0 — GO-2026-6303/6354/6355
etcd/client/pkg/v3	—	override kept at v3.6.14 — GO-2026-6107

How the two survivors were chosen. This branch was first pushed with no overrides at all, to test whether the upgrade alone was enough. CI's scan reported exactly these four findings, so both overrides are reinstated on evidence rather than assumption — and the two that were dropped are confirmed unnecessary by the same run.

Worth noting a local build of v0.93.1 scanned clean, which was misleading; the CI scan of the built image is the authority, and #1003 is what made its findings legible.

The Dockerfile comment now says to check what upstream resolves before touching these, and to delete each one once upstream passes it — so the next finding here reads as a pin to retire rather than an upstream regression.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

Updates the bundled prometheus-config-reloader from v0.91.0 to v0.93.1 and revises its dependency overrides.

• Raises the x/crypto override to v0.56.0.
• Removes obsolete x/net and x/text overrides.
• Documents when and how to retire the remaining override.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
docker/Dockerfile	Updates the reloader source tag and dependency override without an identified blocking failure.

_{Reviews (8): Last reviewed commit: "CP-47363: Upgrade prometheus-config-relo..." | Re-trigger Greptile}

[evan-cz]

Rebuilding against the re-tagged ghcr.io/cloudzero/alloy:v1.19.2-patch-1, which now carries the etcd v3.6.14 fix for GO-2026-6107. No change to this branch — the tag moved, the pin did not.