Fix GO-2026-6612: bump golang.org/x/net to v0.60.0 and Go toolchain to 1.26.9

[Farjaad]

Summary

Fixes GO-2026-6612 (CVE-2026-78663): the HTTP/2 server can refund connection-level flow control twice, which lets a malicious client bypass MaxReceiveBufferPerConnection.

The advisory affects two components:

• golang.org/x/net: fixed in v0.60.0 (was v0.57.0)
• stdlib net/http: fixed in Go 1.26.9 / 1.27.2. Adds toolchain go1.26.9 so that CI (setup-go with go-version-file: go.mod) builds with a patched Go version.

x/net v0.60.0 requires go >= 1.26.0, so the go directive moves from 1.25.0 to 1.26.0, and go mod tidy pulled in minor bumps to the other golang.org/x/* modules.

This supersedes the partial fix in #648, which only reaches x/net v0.58.0 and Go 1.26.0.

Testing

• go build ./... and go test ./... pass on go1.26.9
• govulncheck ./...: GO-2026-6612 is no longer reported. The only remaining module finding is GO-2026-5932 (x/crypto/openpgp, no fix available, not called).

🤖 Generated with Claude Code

[Farjaad]

Why this is safe to merge

It only changes dependency versions; no library code is touched. The diff is go.mod, go.sum and a changelog entry.

opslevel-go is barely exposed to this bug. GO-2026-6612 affects HTTP/2 servers. This library is only an API client and never starts a server. The only thing it uses from golang.org/x/net is publicsuffix, which it gets through resty (go mod why -m golang.org/x/net). govulncheck confirms our code doesn't call the vulnerable functions. We're bumping anyway so that scanners stop flagging the module and so that downstream consumers resolve to a patched x/net.

The other golang.org/x/* bumps are small. go mod tidy moved crypto, sys, text, term, sync, mod and tools up by one or two minor versions. These are the same bumps #648 already proposed.

It's verified:

• CI passes (test, CodeQL, Analyze).
• The CI test job really built with the patched Go: Successfully set up Go version 1.26.9 (from the toolchain go1.26.9 line).
• govulncheck ./... no longer reports GO-2026-6612. The one remaining module finding, GO-2026-5932 (x/crypto/openpgp), has no fix yet and our code doesn't call it.

The one change consumers will notice: the go line moves from 1.25.0 to 1.26.0, because x/net v0.60.0 requires it. Projects that import opslevel-go will need Go 1.26 or newer. Go 1.25 is already out of upstream support now that 1.27 is out, so this shouldn't affect supported setups. The toolchain line only applies when building this module itself; it doesn't force consumers onto 1.26.9.

After merging: #648 will conflict on go.mod/go.sum. Dependabot should rebase it down to just the validator bump.