chore: Update spdystream due to CVE

[Kevinjoeharris]

https://nvd.nist.gov/vuln/detail/CVE-2026-35469

Checklist:

• Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this is a chore.
• The title of the PR is (a) conventional with a list of types and scopes found here, (b) states what changed, and (c) suffixes the related issues number. E.g. "fix(controller): Updates such and such. Fixes #1234".
• I've signed my commits with DCO
• My builds are green. Try syncing with master if they are not.
• I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
• I have run all tests locally (including the flaky ones) and they pass on my workstation
• I have used LLM/AI/Agent tools for this PR but I am responsible for all code of this PR
• I understand what the code does and WHY/HOW it works in several scenarios
• I know if my code is just adding new functionality or changing old functionality for existing users
• My organization is added to USERS.md.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Published E2E Test Results

4 files  8 suites   0s ⏱️
1 tests 0 ✅ 0 💤 1 ❌
0 runs  -4 ✅ 0 💤 4 ❌

For more details on these failures, see this check.

Results for commit 7465cc4.

[github-actions]

Published Unit Test Results

    1 files    130 suites   1m 18s ⏱️
1 530 tests 1 529 ✅ 0 💤  1 ❌
1 529 runs  1 500 ✅ 0 💤 29 ❌

For more details on these failures, see this check.

Results for commit 7465cc4.