security: bump Go toolchain 1.26.5 → 1.26.7 to clear 8 HIGH stdlib CVEs

[parlakisik]

Why

The weekly Security Scan failed its last two runs (32698378537, 32002500440) — 26 of 27 jobs red in the latest, all from a single root cause: the repo is pinned to Go 1.26.5, which carries 8 HIGH-severity stdlib advisories.

Both scanners trip on it independently:

• Trivy flags the stdlib version embedded in every service binary (all 10 image jobs fail).
• govulncheck reports 6 of the 8 as reachable from our own call paths — e.g. httpclient.Client.doWithRetry → http.Client.Do → tls.Dialer.DialContext. 15 of 16 module jobs fail.

This is not new breakage in our code. The same tree passed on 2026-08-10 and began failing on 2026-08-17 — Go 1.26.6 shipped in between, which is when the advisories became actionable. Pass → fail → fail, with no intervening code change.

Advisories cleared

CVE	Go ID	Package	Issue
CVE-2026-33818	GO-2026-5972	encoding/asn1	Denial of service
CVE-2026-56862	GO-2026-6090	crypto/tls	DoS via indefinite KeyUpdate messages
CVE-2026-56853	GO-2026-6089	net/http	Unencrypted HTTP/2
CVE-2026-56860	GO-2026-6218	net/url	DoS from quadratic complexity in path handling
CVE-2026-56858	GO-2026-6091	html/template	Cross-site scripting
CVE-2026-56859	—	encoding/xml	DoS via XML decoding
CVE-2026-39821	—	golang.org/x/net/idna	—
CVE-2026-46600	—	golang.org/x/net/dns/dnsmessage	—

Why 1.26.7 and not the 1.26.6 minimum

All 8 advisories are fixed in 1.26.6, but 1.26.7 is the latest 1.26 patch. I checked every stdlib entry in the Go vulnerability database — none requires a version beyond 1.26.6, so 1.26.7 is a strict superset of the fix with no known regressions, and buys margin before the next bump.

Scope — all 38 pins

Count	Kind	Change
2	Workflows	GO_VERSION in ci.yml, security.yml
13	Dockerfiles	FROM golang:1.26.5-alpine → 1.26.7-alpine
23	go.mod	toolchain go1.26.5 → go1.26.7

Only the toolchain directive moves — the go 1.25.0 directive is untouched, so the language version and module compatibility are unchanged. Diff is exactly 38 files, 38 insertions, 38 deletions: one line each, no collateral.

This deliberately covers five modules the CI matrices don't scan — aex-credentials-provider, aex-telemetry, aex-token-bank, src/internal, internal/testutil — so the pin stays uniform repo-wide and these don't silently drift onto a vulnerable toolchain.

Verification — CI on this PR is the source of truth

Nothing here was validated by building images locally. The image builds and the container scan are verified by the pipelines below, so the result is reproducible from this PR rather than from anyone's laptop:

Workflow	Covers	Run
Security Scan	16 × govulncheck, 10 × Trivy image scan — the checks that were failing	32773605160
CI	16 × Lint & Test (go vet + go test), 14 × Docker Build against golang:1.26.7-alpine	32773605083
E2E Tests	end-to-end suite	32773605113

Watch them on the Checks tab. The bar to merge is simple: Security Pass and CI Pass both green — the same two gates that are red on main today.

Sanity checks run locally against the real 1.26.7 toolchain before pushing (no Docker involved): make build across 11 services, go test and go vet clean across all 23 modules, and go vet -tags e2e for the tagged suite in hack/tests.

Pre-existing findings, untouched

golangci-lint reports errcheck issues in hack/integration, src/internal{,/events,/httpclient}, and aex-token-bank. I confirmed these are byte-identical on main by stashing this diff and re-running — unrelated to this change, and not gated by CI, which runs go vet, not golangci-lint. Worth a separate cleanup PR.