[kaessert]

Description of your changes

Bumps Go to 1.26.10 on release-0.2 to pick up the crypto/x509 fix for CVE-2026-111943 (GO-2026-6809) and moves the runtime base gcr.io/distroless/base-debian11 -> base-debian13, mirroring crossplane-contrib/function-patch-and-transform#380 and crossplane-contrib/function-sequencer#203. v0.2.0 ships a /function built with go1.25.6; the fix is only in 1.26.10 and 1.27.3. Please cut v0.2.1 from release-0.2 after merge.

GOLANGCI_VERSION moves v2.4.0 -> v2.11.4: v2.4.0 is built with Go 1.25 and can't lint a go 1.26.10 module. v2.11.4 matches function-sequencer#203 and reports 0 issues here.

go.mod moves from go 1.25.0 to go 1.26.10 as in #380, so every build of the module needs a 1.26.10+ toolchain. That also flips four default GODEBUG settings to their 1.26 values: cryptocustomrand, httpservecontentmaxranges, tlssecpmlkem, urlstrictcolons.

Tests

Local, Go 1.26.10:

• go mod tidy: no diff
• golangci-lint v2.11.4 config verify and run: 0 issues
• go test -v -cover ./...: 3 --- PASS, 0 --- FAIL
• govulncheck ./...: GO-2026-6809 not reported; 6 other reachable findings remain (4 in golang.org/x/net, fixed in v0.60.0; 2 in google.golang.org/grpc, fixed in v1.83.1), not addressed here

I have:

• Read and followed Crossplane's contribution process.
• Added or updated unit tests for my change.