fix(security): clear 20 HIGH image CVEs — x/crypto 0.52.0 + Go 1.25.11 builder

[devonartis]

What

Clears all 20 HIGH CVEs that a trivy scan of the built broker image reported in the Go binary. Zero findings remain after this change (verified: trivy --severity HIGH,CRITICAL reports Total: 0 on the rebuilt image).

CVE groups and fixes

1. golang.org/x/crypto v0.48.0 → v0.52.0 — 8 HIGH, all in x/crypto/ssh:
CVE-2026-39827, -39828, -39829, -39830, -39832, -39835, CVE-2026-42508, CVE-2026-46595, -46597.
Pulls x/sys v0.41.0 → v0.45.0; raises the go.mod go directive 1.24.0 → 1.25.0 (x/crypto's minimum).

2. Dockerfile builder golang:1.24-alpine → golang:1.25-alpine (digest-pinned per project convention; the new digest ships Go 1.25.11) — 12 HIGH Go stdlib CVEs across net/url, crypto/x509, crypto/tls, net, HTTP/2, net/mail, mime:
CVE-2026-25679, -27145, -32280, -32281, -32283, -33811, -33814, -39820, -39836, -42499, -42504.

Root cause worth knowing

Official golang Docker images set GOTOOLCHAIN=local, so the toolchain go1.25.11 directive in go.mod (bumped 2026-06-29) was silently ignored inside Docker builds — the shipped binary was still built against the image's Go 1.24.13 stdlib. The builder tag must track the toolchain directive; a Dockerfile comment now documents the trap.

Surfaced by the new container-scan (trivy) gate on the private GitLab CI — GitHub CI has no image-level CVE gate, so these accumulated unseen.

Verification

• go build ./cmd/broker ./cmd/awrit — OK
• go test -short -count=1 ./... — all packages ok
• gofmt -l . — clean
• Rebuilt image trivy scan: Total: 0 HIGH/CRITICAL (alpine layer and gobinary)

Note

The public Docker Hub image only refreshes on the next release merge (develop → main) — this PR fixes develop; the shipped image stays on the old stdlib until the owner calls a release.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

go.mod

Package	Version	License	Issue Type
golang.org/x/crypto	0.52.0	Null	Unknown License
golang.org/x/sys	0.45.0	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
gomod/golang.org/x/crypto	0.52.0	Unknown	Unknown
gomod/golang.org/x/sys	0.45.0	Unknown	Unknown

Scanned Files

• go.mod