chore: bump zoekt submodule to upgrade golang.org/x/net and golang.org/x/crypto (CVEs)

Advances the vendor/zoekt submodule to sourcebot-dev/zoekt#16, which upgrades
golang.org/x/net v0.53.0 -> v0.55.0 and golang.org/x/crypto v0.50.0 -> v0.52.0
to address the Trivy container-scan HIGH CVEs:

- x/net: CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821,
  CVE-2026-42502, CVE-2026-42506
- x/crypto: CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830,
  CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: brendan-kellam