chore(deps): bump github.com/crossplane/crossplane/apis/v2 from 2.3.2 to 2.3.3

[dependabot]

Bumps github.com/crossplane/crossplane/apis/v2 from 2.3.2 to 2.3.3.

Release notes

Sourced from github.com/crossplane/crossplane/apis/v2's releases.

v2.3.3

v2.3.3 is a patch release scoped to fixing issues reported by users of Crossplane v2.3 and fixing security related issues in Crossplane's dependencies.

🎉 Highlights

• Fixed package signature verification TOCTOU (GHSA-mf7q-r4rv-jv94): A time-of-check-to-time-of-use flaw could let a malicious OCI registry pass signature verification with a signed image and then serve unsigned content for installation. For v2.3 this fix ships via the crossplane-runtime v2.3.3 bump in #7541, since the affected code moved from crossplane to crossplane-runtime during the v2.3 milestone. See the crossplane-runtime v2.3.3 release notes for the full details.
• Correct namespace on injected resource refs in crossplane render: crossplane render previously set a namespace on every injected resource reference, which is inaccurate for namespaced XRs (whose resource refs are local and carry no namespace) and broke composition functions with strict schemas, such as the generated KCL bindings used in control plane projects. Render now matches the real reconciler and sets the namespace only for cluster-scoped XRs. Backported in #7525, originally fixed in #7523.
• Dependency security updates: This release also bumps the Go toolchain to 1.25.11 and golang.org/x/net and golang.org/x/sys in the apis module to pick up CVE fixes (#7530). See ## What's Changed below for the full list.

What's Changed

• [Backport release-2.3] render: Set namespace on injected resource refs only for cluster-scoped XRs by @​github-actions[bot] in crossplane/crossplane#7525
• [release-2.3] bump Go to 1.25.11 and apis golang.org/x/net, x/sys for CVEs [security] by @​phisco in crossplane/crossplane#7530
• Update crossplane-runtime to v2.3.3 by @​lsviben in crossplane/crossplane#7541

Full Changelog: crossplane/crossplane@v2.3.2...v2.3.3

Commits

• 09ffaea Merge pull request #7541 from lsviben/bump-runtime-v2.3.3
• 0be292e Update crossplane-runtime to v2.3.3
• 14f652a Merge pull request #7530 from crossplane/security/release-2.3-go1.25.11-apis-...
• fce3924 fix(deps): bump golang.org/x/net and golang.org/x/sys in apis for CVEs [secur...
• 63cc0b8 build(deps): bump Go to 1.25.11 [security]
• 697e7aa Merge pull request #7525 from crossplane/backport-7523-to-release-2.3
• 583da65 render: Set namespace on injected resource refs only for cluster-scoped XRs
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)