chore: build with Go 1.26 and update vulnerable dependencies

[anupam-sl]

Why

saucectl release binaries are currently built with Go 1.23 (go1.23.12), a toolchain line that stopped receiving security patches in August 2025. Vulnerability scanners therefore flag the released binaries for the unpatched Go standard library (38 known CVEs to date per OSV, none of which will ever be fixed on the 1.23 line), alongside outdated golang.org/x/net v0.33.0, golang.org/x/crypto v0.31.0 and go-git v5.13.1 module versions embedded in the build metadata. Users who package saucectl into container images see these findings in their image scans.

What

• Build and CI now take the Go version from go.mod (go-version-file), bumped to Go 1.26 — one place to bump going forward. Applies to the release, test and CodeQL workflows plus the Dockerfile build stage.
• Dependency upgrades for the flagged modules: go-git v5.13.1 → v5.19.2, x/net v0.33.0 → v0.57.0, x/crypto v0.31.0 → v0.54.0, plus transitive x/* bumps via go mod tidy.
• golangci-lint bumped to v2 (action @v9): the v1.64 line is built with Go 1.24 and cannot typecheck a go 1.26 module. .golangci.yml is migrated to the v2 config format preserving the previous behavior — same linters, v1's implicit default exclusions now declared explicitly, goimports moved to the formatters section.

Supersedes #1026, #1055 and #1070.

Verification

• go build ./... and go test ./... pass with go1.26.5.
• golangci-lint run (v2.12.2): 0 issues.
• govulncheck ./...: 0 vulnerabilities affecting saucectl code. The only remaining module-level advisory is GO-2026-5932 — the deprecated x/crypto/openpgp package, which saucectl does not import and which has no fixed version to upgrade to.
• go version -m on a test build (the metadata that version-based scanners inspect) now reports go1.26.5 and the updated module versions.

🤖 Generated with Claude Code

[anupam-sl]

CI note: the failing xctest check is unrelated to this change — the same job fails identically on unmodified main (still built with the current Go 1.23 toolchain): https://github.com/saucelabs/saucectl/actions/runs/30482963346

The failure is an assertion inside the fixture app itself (RunnerTests.testFirstTestingScenarioIncrement5Decrement3 → ((success) is true) failed - Instance of 'FlutterErrorDetails'), reproduced across three different device allocations (iPhone 12, iPhone 16 Pro on this PR's runs; iPhone 15 Pro on the main control run), all on iOS 18.7.2, three in-run retries each. The same fixture passed on 2026-07-23 (https://github.com/saucelabs/saucectl/actions/runs/30004577406), so it regressed on the device-cloud side between Jul 23 and Jul 29 independently of any code change. In every one of these runs saucectl uploads, schedules, retries and reports correctly.

All 16 other checks on this PR are green.