[jakubramut]

Description of your changes

Bumps Go to 1.26.10 on release-0.3 to pick up the crypto/x509 fix for CVE-2026-111943 (GO-2026-6809) and moves the runtime base gcr.io/distroless/base-debian11 -> base-debian13, mirroring crossplane-contrib/function-patch-and-transform#380. v0.3.0 ships a /function built with go1.25.4; the fix is only in 1.26.10 and 1.27.3. Please cut v0.3.1 from release-0.3 after merge.

GOLANGCI_VERSION moves v2.6.2 -> v2.11.4: v2.6.2 is built with Go 1.25 and refuses the module (can't load config: the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.10)); v2.12.2 reports 3 goconst issues on this tree.

go.mod moves to go 1.26.10 as in #380, so every build of the module needs a 1.26.10+ toolchain. That also flips nine default GODEBUG settings from their 1.24 values: containermaxprocs, cryptocustomrand, decoratemappings, httpservecontentmaxranges, tlssecpmlkem, tlssha1, updatemaxprocs, urlstrictcolons, x509sha256skid. The most visible: GOMAXPROCS now follows the container CPU limit.

Tests

Local, Go 1.26.10:

• go mod tidy: no diff
• golangci-lint v2.11.4 config verify and run: 0 issues
• go test -v -cover ./...: 12 --- PASS, 0 --- FAIL
• govulncheck ./...: GO-2026-6809 no longer reported; 6 other reachable findings remain (4 in golang.org/x/net, fixed in v0.60.0; 2 in google.golang.org/grpc, fixed in v1.83.1), not addressed here
• docker build --platform linux/amd64 --build-arg GO_VERSION=1.26.10 --target image: /function built with go1.26.10 on Debian 13, user nonroot:nonroot, --help exits 0

I have:

• Read and followed Crossplane's contribution process.
• Added or updated unit tests for my change.