Bump lib-commons to >= v5.0.2 (observability fix)

[gandalf-at-lerian]

Context

Two bugs were identified in the observability instrumentation provided by lib-commons:

1. Race condition on HTTP method labels — concurrent access corrupts http_method values (e.g. GET → GETT, POS, GETC), multiplying time series and inflating request metrics (calls_total).

2. Incorrect span classification — INTERNAL spans were being classified as SPAN_KIND_SERVER, duplicating call counts for service-internal operations.

Both issues are fixed in lib-commons v5.0.2.

Impact

• Inflated calls_total metrics across all environments
• Unreliable observability dashboards
• Increased metric storage cost (spurious time series)

Action Required

1. Update lib-commons dependency to >= v5.0.2 in go.mod
2. Run go mod tidy
3. Open PR, validate CI
4. Release new version
5. Coordinate deployment to client environments

Reference

• Jira: DSINT-1105
• Thread: #devops-team investigation
• Requested-by: @gabrielferreira-lerian (Ferreira)

Current version in this repo: v4.2.0