chore(deps): bump the go-all group across 1 directory with 4 updates (#2982)

* chore(deps): bump the go-all group across 1 directory with 4 updates

Bumps the go-all group with 4 updates in the / directory: [github.com/stretchr/testify](https://github.com/stretchr/testify), [golang.org/x/net](https://github.com/golang/net), [golang.org/x/sys](https://github.com/golang/sys) and [golang.org/x/term](https://github.com/golang/term).


Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](https://github.com/stretchr/testify/compare/v1.11.1...v1.12.1)

Updates `golang.org/x/net` from 0.57.0 to 0.59.0
- [Commits](https://github.com/golang/net/compare/v0.57.0...v0.59.0)

Updates `golang.org/x/sys` from 0.47.0 to 0.48.0
- [Commits](https://github.com/golang/sys/compare/v0.47.0...v0.48.0)

Updates `golang.org/x/term` from 0.45.0 to 0.46.0
- [Commits](https://github.com/golang/term/compare/v0.45.0...v0.46.0)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-all
- dependency-name: golang.org/x/net
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-all
- dependency-name: golang.org/x/sys
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-all
- dependency-name: golang.org/x/term
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-all
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(deps): keep go directive unpinned so CI uses latest patch

Dependabot's go mod tidy on a newer toolchain rewrote the directive to
go 1.26.0, which makes actions/setup-go (go-version-file: go.mod) install
exactly 1.26.0 instead of the latest 1.26.x patch. govulncheck then fails
on 18 standard-library CVEs already fixed in 1.26.6.

Restore the go 1.26 + toolchain form used on next.

* fix(ci): install latest Go 1.26 patch instead of pinning 1.26.0

The x/net, x/sys and x/term bumps declare go 1.26.0, so go mod tidy now
requires the module's go directive to be go 1.26.0 rather than go 1.26.
setup-go's go-version-file reads that directive verbatim and installs
exactly 1.26.0, which govulncheck flags for 18 standard-library CVEs
already fixed in later 1.26 patches.

Resolve the Go version from the 1.26 minor line so the latest patch is
installed.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jo <me@jguer.space>

.github/workflows/testing-git.yml

@@ -20,7 +20,9 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
-          go-version-file: go.mod
+          # Use the latest 1.26.x patch (go.mod pins go 1.26.0, which
+          # setup-go would otherwise resolve to that exact patch release).
+          go-version: "1.26"
       - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/go/pkg/mod