fix: pin Go toolchain to 1.26.8 and bump vulnerable dependencies

[cspath1]

This Action has the same exposure that ld-find-code-refs 2.18.0 fixed, independently: its own module vendored ld-find-code-refs v2.16.0, which predates that work, alongside x/crypto v0.52.0 and x/text v0.37.0.

govulncheck reported 22 reachable standard library vulnerabilities, plus 8 in imported packages and 10 in required modules. CVE-2025-68121 (crypto/tls) was reachable via internal/ldclient/flag_links.go:73.

Root cause for the standard library findings is the same as upstream: a go directive with no toolchain directive pins nothing, so the build uses whatever Go happens to be present. Here it was compounded by the Dockerfile building FROM golang:alpine -- a floating tag, so since action.yml is a using: docker / image: Dockerfile action that GitHub rebuilds on every run, the toolchain silently changed between runs and an image scan gave different answers at different times.

Changes:
go directive 1.25.0 -> 1.26.0, plus toolchain go1.26.8
ld-find-code-refs/v2 v2.16.0 -> v2.18.1
x/crypto v0.52.0 -> v0.57.0
x/text v0.37.0 -> v0.42.0
x/oauth2 v0.33.0 -> v0.37.0
go-git/v5 v5.19.1 -> v5.19.2
builder image golang:alpine -> golang:1.26.8-alpine
runtime image alpine:3.21 -> alpine:3.24.2

govulncheck after: 0 vulnerabilities.

No lint changes needed. CI builds golangci-lint from source via pre-commit after setup-go, so it picks up the pinned toolchain and the existing v1.62.2 pin still passes; verified by building v1.62.2 with go1.26.8 and running the pre-commit invocation.

---

Note

Overview
Pins a reproducible Go toolchain and refreshes dependencies so the Docker-based GitHub Action no longer picks up a floating compiler or stale vulnerable modules.

Module / build: go moves to 1.26.0 with toolchain go1.26.8. Direct and indirect bumps include ld-find-code-refs/v2 v2.16.0 → v2.18.1, golang.org/x/crypto, x/text, x/oauth2, and go-git/v5, with matching vendor/ updates (including go-git ReferenceName.IsSafe() and small validation-message fixes in the vendored ld-find-code-refs options).

Docker: builder image golang:alpine → golang:1.26.8-alpine; runtime alpine:3.21 → alpine:3.24.2, so each action rebuild uses the same Go and base OS instead of whatever the floating tag resolved to.

There are no changes to this repo’s own Go source—only toolchain, Dockerfile, go.mod/go.sum, and vendor.

^{Reviewed by Cursor Bugbot for commit 6c336ea. Bugbot is set up for automated code reviews on this repo. Configure here.}