[TheoBen880]

This PR makes the Security workflow pass again. The govulncheck job fails on main because Go 1.25 has known vulnerabilities in the standard library, and the fixes are only in Go 1.26.9 and later.

Before and after

Before: CI uses Go 1.25 (go1.25.14). govulncheck finds 9 standard library vulnerabilities and the job fails with exit code 3.

After: CI, the Security workflow, and the Docker image use Go 1.26 (go1.26.10 today). govulncheck exits with code 0.

Risk

CI and the Docker image now build with Go 1.26. The minimum Go version in go.mod does not change. Reverting this PR fully undoes it.

Evidence

govulncheck@v1.7.0 ./... on go1.26.10, the same command that CI runs:

No vulnerabilities found.
exit: 0

I did not run the test suite locally. The CI checks on this PR will show it.

What changed

Bug fixes:

• CI, the Security workflow, and the Docker image use Go 1.26 instead of Go 1.25.

Checklist

• Change all Go 1.25 pins to 1.26
• Run govulncheck on go1.26.10
• CI checks pass on this PR