build(iam2): bump v0.15.1 → v0.15.4 (federation SuperAdmin-mint CRITICAL fix)

v0.15.4 closes the red-team CRITICAL in the federation broker: authorize
Application.Organization on write + reserved-org guard in federation
link/provision (was: social login could mint a SuperAdmin / take over a
cross-tenant account) + SSRF IP filter. Required before the hanzo.id social
cutover. Build pipeline healthy (consensus v1.36.3).

go.mod

@@ -18,7 +18,7 @@ require (
 	github.com/hanzoai/decimal v0.1.1
 	github.com/hanzoai/goa v1.0.0
 	github.com/hanzoai/iam v1.31.28
-	github.com/hanzoai/iam2 v0.15.1
+	github.com/hanzoai/iam2 v0.15.4
 	github.com/hanzoai/money v0.2.1
 	github.com/hanzoai/notify v1.6.18
 	github.com/hanzoai/otel-collector v1.2.0

go.sum

@@ -1252,6 +1252,8 @@ github.com/hanzoai/iam v1.31.28 h1:bEKm4x7Ghy0LQD+GeMjeMhzBwIYjJV+6UlGwCkHCi4U=
 github.com/hanzoai/iam v1.31.28/go.mod h1:7kl/z2j0QQ+DFmQsq8S//ypDLkyl6VDsY4owK3fKbJU=
 github.com/hanzoai/iam2 v0.15.1 h1:eyCY46zCN/UYqo4rl22l84zZ0ozeuLq+SPNTnFdrP+0=
 github.com/hanzoai/iam2 v0.15.1/go.mod h1:40YxnxnRgEH+ARZs+qL2An+B1HhOVkbtohr0KJtbtFg=
+github.com/hanzoai/iam2 v0.15.4 h1:72toIXjXKiTPhyjIe004UY1IiD6fC3x19zFpe4w3wSg=
+github.com/hanzoai/iam2 v0.15.4/go.mod h1:40YxnxnRgEH+ARZs+qL2An+B1HhOVkbtohr0KJtbtFg=
 github.com/hanzoai/iamsdk/v2 v2.1.2 h1:u86WwM76e46YUrDbvB5k5hD2g+t9oqT5PmssKC5+El8=
 github.com/hanzoai/iamsdk/v2 v2.1.2/go.mod h1:oBI91+bAbrIt2MEPYuXUM6NinpjwcREz85sccdDkUY4=
 github.com/hanzoai/idv v1.0.3 h1:x4v5VjCv8onxLsWRSOrRifxLdYEvYBQjYzgnv1NNeKg=