Fix GO-2026-6612: bump Go to 1.26.9 and x/net to v0.60.0

[Farjaad]

Fixes GO-2026-6612 (Critical): the HTTP/2 server could refund connection-level flow control twice for the same data, letting a client bypass MaxReceiveBufferPerConnection.

• toolchain go1.26.4 → go1.26.9 (stdlib fix)
• golang.org/x/net v0.55.0 → v0.60.0 (also pulls minor bumps of other golang.org/x/* modules)

govulncheck ./... no longer reports GO-2026-6612; go test ./... passes.

🤖 Generated with Claude Code

[Farjaad]

Why this is safe to merge

Only dependency versions change. The diff touches src/go.mod, src/go.sum and one changelog entry. No application code changes.

Every bump stays within its current major version:

• Go toolchain 1.26.4 → 1.26.9 is a patch release. Go patch releases only contain security and bug fixes. The go 1.26.0 language version is unchanged.
• golang.org/x/net v0.55.0 → v0.60.0 fixes the vulnerability.
• golang.org/x/{crypto,mod,sync,sys,term,text,tools} were raised to the minimum versions the new x/net requires. All of them are indirect dependencies, and the golang.org/x modules keep compatibility across minor releases.

Checks

• go build ./... and go test ./... pass locally and in CI (test, CodeQL, Analyze all green).
• govulncheck ./... no longer reports GO-2026-6612. It still lists two other advisories, GO-2026-5158 and GO-2026-5932, but finds no path from our code to them. They were there before this PR and aren't affected by it.

Build and release: the CI and release workflows read the Go version from src/go.mod (go-version-file), so release binaries will be built with 1.26.9. The Dockerfile's golang:alpine stage only copies CA certificates and doesn't compile anything, so it needs no change.

Rollback: if anything goes wrong, reverting this commit restores the previous versions.

🤖 Generated with Claude Code