fix: pin deps with breaking changes and fix LDAP TLS regression (#15)

Replace minio/pkg/v3 with pgsty/minio-pkg/v3 v3.6.3 to fix LDAP TLS
regression where DialURL() was not passing TLS config for ldaps://
connections, causing InsecureSkipVerify and RootCAs to be silently
ignored (x509: certificate signed by unknown authority).

Pin four dependencies to avoid breaking changes introduced in 5abd9a80f:
- go-ldap/ldap/v3 v3.4.12: v3.4.13 rewrote GetLDAPError() internals
- IBM/sarama v1.45.1: v1.46.0 changed Kafka protocol version negotiation
- lib/pq v1.10.9: v1.11.0 treats nil []byte as NULL and drops PG <14
- etcd v3.6.8: stay on intermediate version per policy

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dockerscripts/download-static-curl.sh

@@ -1,8 +1,12 @@
 #!/bin/bash
 
+# Pin to v8.11.0 – the last release that includes curl-aarch64.
+# v8.17.0 (current latest) dropped the aarch64 build.
+STATIC_CURL_VERSION="v8.11.0"
+
 function download_arch_specific_executable {
 	curl -f -L -s -q \
-		https://github.com/moparisthebest/static-curl/releases/latest/download/curl-$1 \
+		"https://github.com/moparisthebest/static-curl/releases/download/${STATIC_CURL_VERSION}/curl-$1" \
 		-o /go/bin/curl || exit 1
 	chmod +x /go/bin/curl
 }