[release-branch.go1.18] net/http: update bundled golang.org/x/net/http2

Disable cmd/internal/moddeps test, since this update includes PRIVATE
track fixes.

Fixes CVE-2022-27664
Fixes golang#53977
For golang#54658.

Change-Id: I84b0b8f61e49e15ef55ef8d738730107a3cf849b
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1554415
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/428635
Reviewed-by: Tatiana Bradley <tatiana@golang.org>
Run-TryBot: Michael Knyszek <mknyszek@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>

src/cmd/internal/moddeps/moddeps_test.go

@@ -34,6 +34,8 @@ import (
 // See issues 36852, 41409, and 43687.
 // (Also see golang.org/issue/27348.)
 func TestAllDependencies(t *testing.T) {
+	t.Skip("TODO(#53977): 1.18.5 contains unreleased changes from vendored modules")
+
 	goBin := testenv.GoToolPath(t)
 
 	// Ensure that all packages imported within GOROOT