Upgrade Go from 1.26.2 to 1.26.3 to fix stdlib vulnerabilities

[maniSbindra]

Problem

The CI vulncheck job is failing on main because Go 1.26.2 has known standard library vulnerabilities that are fixed in Go 1.26.3.

Failed run: https://github.com/microsoft/sbi/actions/runs/25539512636

Vulnerabilities found (all fixed in Go 1.26.3)

ID	Summary	Affected Package
GO-2026-4918	Infinite loop in HTTP/2 transport (bad SETTINGS_MAX_FRAME_SIZE)	net/http
GO-2026-4981	Crash when handling long CNAME response	net
GO-2026-4986	Quadratic string concatenation in consumeComment	net/mail
GO-2026-4982	XSS via meta content URL escaping bypass	html/template
GO-2026-4980	Escaper bypass leads to XSS	html/template
GO-2026-4977	Quadratic string concatenation in consumePhrase	net/mail
GO-2026-4976	ReverseProxy forwards excess query params	net/http/httputil

2 of these directly affect SBI code paths (net/http used in registry.go).

Fix

Update go.mod from go 1.26.2 to go 1.26.3. All CI workflows use go-version-file: go.mod, so they will automatically pick up the new version.

Labels

security, bug