Fix govulncheck failures (9 CVEs in Go dependencies)

[mohammedfirdouss]

What would you like to be added:
Fix the govulncheck CI failures detected in PR #6435 by addressing known vulnerabilities across affected modules:

• GO-2025-4007, GO-2025-4008, GO-2025-4009, GO-2025-4010, GO-2025-4011
• GO-2025-4012, GO-2025-4013, GO-2025-4155, GO-2026-4603

Affected modules include:

• . (root module)
• ./tool/actions-plan-preview
• ./tool/actions-gh-release
• ./pkg/app/pipedv1/plugin/*

Reference workflow run:

• https://github.com/pipe-cd/pipecd/actions/runs/23225026408

Main failing jobs:

• https://github.com/pipe-cd/pipecd/actions/runs/23225026408/job/67505807200
• https://github.com/pipe-cd/pipecd/actions/runs/23225026408/job/67505807194
• https://github.com/pipe-cd/pipecd/actions/runs/23225026408/job/67505807219

Why is this needed:

• The new govulncheck CI gate is correctly identifying vulnerabilities that currently block PR merges.
• Several findings impact reachable code paths and should be remediated before enabling/merging the checks.
• Resolving these vulnerabilities keeps PipeCD’s CI security posture consistent with the dependency-scanning effort tracked in Add continuous dependency vulnerability scanning with Dependabot and govulncheck #6409.

cc: @Warashi @khanhtc1202

[Warashi]

Hi, @mohammedfirdouss
I assigned you to this issue because you are actually trying this.

[mohammedfirdouss]

Hi, @mohammedfirdouss
I assigned you to this issue because you are actually trying this.

Yes @Warashi I had to work on the issues with the multi cluster plugin, so I had to push this forward. Thank you for the reminder. Would work on the updates soon.

[khanhtc1202]

@mohammedfirdouss Thanks for the idea, I had merged a lot of dependabot update around the go module, so I think it would be great if you can rebase your PR. After that, let try retrigger this CI again, I think all would pass fine

[mohammedfirdouss]

Okay no problem @khanhtc1202

[khanhtc1202]

@mohammedfirdouss I'm about to submit a go version update (to 1.26.2) for pipecd, maybe we can postpone this til the go version is fixed, wdyt?

[mohammedfirdouss]

Yes yes that works, I was about to push some changes tho. I'll wait @khanhtc1202

[mohammedfirdouss]

The current version has some reasons for this failure

[khanhtc1202]

@mohammedfirdouss Opened the PR for update go version for pipecd components to v1.26.2
#6711