fix: [sc-19289] use stdlib crypto/sha3 so x/crypto bump can land - #13

Unblocks the Dependabot security PR keeman#11 (golang.org/x/crypto 0.41.0 to 0.52.0).

After #12 fixed the stale CI, #11 still failed on a single genuine finding:

pkg/tor/onion.go:91 [failure] inline: Call of sha3.Sum256 should be inlined (govet)

Cause: x/crypto 0.52.0 annotates its sha3 wrappers with a go:fix inline directive pointing at the standard library crypto/sha3 (added in Go 1.24), and golangci-lint v2 runs the govet inline analyser that enforces it. It did not fire on #12 because that PR did not carry the bump.

Change:

• pkg/tor/onion.go imports crypto/sha3 from the standard library instead of golang.org/x/crypto/sha3. The call site is unchanged: both expose Sum256([]byte) [32]byte.
• go.mod go directive 1.23.0 to 1.24.0, required because crypto/sha3 entered std in Go 1.24. The toolchain line already declares go1.24.6 and CI now runs 1.24.x, so this only makes the existing requirement explicit.

Worth noting: pkg/tor/onion.go was the ONLY direct consumer of golang.org/x/crypto in this repo, so after this change the module no longer imports it directly. Any remaining exposure is transitive, which #11 still covers by lifting the resolved version to 0.52.0.

Acceptance: this PR green, then #11 rebases green and merges, clearing 7 criticals in keeman.

Ref: [sc-19289]