deps(gobgp): bump osrg/gobgp from v3.37.0 to v4.8.0

[Rissochek]

Summary

• Bump optional GoBGP integration from github.com/osrg/gobgp/v3 v3.37.0 to v4 v4.8.0
• Update interop and deployment example GoBGP container images to jauderho/gobgp:v4.8.0
• Document GoBGP v4+ compatibility contract (/api.GoBgpService/*) and migration notice
• Replace deprecated golang.org/x/net/http2/h2c in cmd/gobfd/shutdown.go with standard http.Protocols
• Re-scope GO-2026-4736 allowlist entry to github.com/osrg/gobgp/v4
• Add in-memory bufconn unit test coverage for GoBGP v4 client in internal/gobgp/client_test.go
• Reconcile stale v3 references in documentation and test suites

Breaking Changes & Migration

• Wire-level compatibility: GoBFD now communicates with GoBGP v4+ (/api.GoBgpService/*). External gobgpd instances must be upgraded to v4.0.0+ as legacy /apipb.GobgpApi/* endpoints are no longer supported.

Validation

• make build (PASS)
• make test (PASS — all unit tests including new bufconn GoBGP v4 tests pass with -race)
• make lint (PASS — SA1019 h2c and protogetter resolved)
• make lint-docs (PASS — markdown, YAML, cspell)
• make proto-lint (PASS)
• make interop-bgp-test (PASS — FRR, BIRD3, ExaBGP)
• make interop-rfc-test (PASS — RFC 7419, RFC 9384, RFC 9468, RFC 9747)
• make vulncheck — GO-2026-4736 scoped allowlist is accepted; remaining findings are upstream stdlib/toolchain-level.

Change Type

• deps
• breaking

Documentation

• docs/en/ updated (configuration notice, RFC compliance contract)
• docs/ru/ updated
• CHANGELOG.md updated
• CHANGELOG.ru.md updated

[dantte-lp]

Blocking findings from review of 4dba798:

1. This is a wire-level compatibility break, not only a Go import rename. GoBGP v3 exposes /apipb.GobgpApi/EnablePeer and /apipb.GobgpApi/DisablePeer; v4 exposes /api.GoBgpService/EnablePeer and /api.GoBgpService/DisablePeer and does not register the legacy service. A GoBFD binary from this PR therefore cannot control an external gobgpd v3 instance. Please define and document the compatibility contract (v4+ minimum plus migration note, or dual-version support) and remove the “No protocol behavior change” claim.

2. Fresh validation of this exact head passes go mod tidy -diff, go build ./..., go test ./... -race -count=1, and go vet ./..., but required gates fail:

   • go tool golangci-lint run ./...: two SA1019 failures for deprecated golang.org/x/net/http2/h2c / h2c.NewHandler after the x/net v0.55.0 bump.
   • go run ./scripts/vuln-audit.go: fails on GO-2026-4736 for gobgp/v4 plus current stdlib/x/net/x/text/x/mod findings. Removing the scoped allowlist does not produce a green vulnerability gate while the Go vulnerability record still marks v4 affected.

3. The migration leaves stale v3-specific documentation and comments, including docs/en/05-interop.md, docs/en/08-rfc-compliance.md, the RU mirror, internal/gobgp/rfc9384.go, and both GoBGP interop test files. These need reconciliation with the new minimum version.

4. Unit tests compile against v4 but do not exercise GRPCClient.EnablePeer or DisablePeer through a real/bufconn GoBGP service. Please add runtime coverage for the renamed v4 service and provide a fresh full CI/E2E run.

[Rissochek]

Thank you for the review, all blocking findings have been addressed in the updated commit:

1. Wire-level Compatibility Contract & Migration:

   • Documented the GoBGP v4.0.0+ minimum requirement and migration guide in docs/en/03-configuration.md, docs/ru/03-configuration.md, docs/en/08-rfc-compliance.md, and docs/ru/08-rfc-compliance.md.
   • Updated CHANGELOG.md and CHANGELOG.ru.md marking this as a breaking change for external GoBGP daemons.
   • Updated PR summary and marked breaking change explicitly.

2. Quality Gates & Deprecations:

   • golangci-lint (SA1019): Replaced deprecated golang.org/x/net/http2/h2c wrapper in cmd/gobfd/shutdown.go with Go standard http.Protocols.SetUnencryptedHTTP2(true).
   • vuln-audit.go: Re-scoped the GO-2026-4736 allowlist entry to github.com/osrg/gobgp/v4 so GoBGP is cleanly allowed.
   • Fixed protogetter accesses in tests.

3. Reconciled v3 Docs & Comments:

   • Replaced stale GoBGP v3 mentions and badge references across docs/en/05-interop.md, docs/ru/05-interop.md, internal/gobgp/rfc9384.go, internal/gobgp/client.go, test/interop-bgp/bgp_bfd_test.go, and test/interop-rfc/rfc_test.go.

4. Runtime Unit Test & E2E Validation:

   • Added in-memory bufconn unit tests in internal/gobgp/client_test.go exercising DisablePeer, EnablePeer, error handling, and connection lifecycle against apipb.GoBgpServiceServer.
   • Fresh local validation passed: make build, make test, make lint, make lint-docs, make proto-lint, make interop-bgp-test, and make interop-rfc-test.