(fix)CVE: bump go version to 1.26.6

[ngelman1]

Changes

CVEs fixed

CVE	Package	Severity	Description
CVE-2026-56865	x/mod/sumdb/tlog	Critical	Transparency log tile verification bypass allowing malicious GOPROXY to serve undetectable malicious module content
CVE-2026-56864	x/mod/sumdb	Critical	Malicious GOSUMDB could serve arbitrary module content not in the transparency log
CVE-2026-56862	crypto/tls	High	Unbounded post-handshake messages causing resource exhaustion
CVE-2026-56860	net/url	High	Quadratic complexity in resolvePath
CVE-2026-56859	encoding/asn1	Medium	Stack exhaustion via recursive ASN.1 structures
CVE-2026-56853	encoding/xml	Medium	Stack exhaustion via recursive XML decode
GO-2026-6091	html/template	Medium	JavaScript regexp context tracking fix
GO-2026-6089	net/http	Medium	ReadHeaderTimeout bypass on unencrypted HTTP/2

Resolves: SRVKP-14152

Validation

• go mod tidy ✅
• go mod vendor ✅
• go build ./... ✅

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Has Docs included if any changes are user facing
• Has Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

Bump Go toolchain to 1.26.6 to fix CVE-2026-56865, CVE-2026-56864, CVE-2026-56862, CVE-2026-56860, CVE-2026-56859, and CVE-2026-56853.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign enarha after the PR has been reviewed.
You can assign the PR to them by writing /assign @enarha in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.55%. Comparing base (b615830) to head (73daf8c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2001   +/-   ##
=======================================
  Coverage   72.55%   72.55%           
=======================================
  Files          58       58           
  Lines        3855     3855           
=======================================
  Hits         2797     2797           
  Misses        764      764           
  Partials      294      294           

Flag	Coverage Δ
unit-tests	72.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[enarha]

I see only the Go version bump in the diff. If there were no updates on the libs, you should remove them from the PR description. Should that PR be opened to main or specific release branch?