Bump Go toolchain to 1.25.13 to resolve stdlib Snyk vulnerabilities

[devin-ai-integration]

Closes: N/A (Snyk security audit remediation)

Summary

All 13 high-severity Snyk findings for this repo are Go standard-library vulnerabilities pinned by the go 1.23.7 directive in go.mod. There are no third-party dependency or SAST findings.

• go.mod: go 1.23.7 → go 1.25.13 — the minimum version that satisfies every "fixed in" range (the net/http and net/url issues require ≥1.25.13 on the 1.25 line).
• Dockerfile: build stage golang:1.24.4-alpine → golang:1.25.13-alpine so the shipped binary is built with the patched stdlib too.
• .github/workflows/lint.yml: golangci-lint v2.1 → v2.5 (v2.1 is built with Go 1.24 and refuses a 1.25 target), and go-version: stable → go-version-file: go.mod (matching the other workflows) so the toolchain golangci-lint type-checks against matches the one it was built with.

go mod tidy produced no changes to go.mod requirements or go.sum.

Snyk issues resolved

Package	Issue IDs
std/crypto/x509	SNYK-GOLANG-STDCRYPTOX509-14545542, SNYK-GOLANG-STDCRYPTOX509-14545554, SNYK-GOLANG-STDCRYPTOX509-15928851, SNYK-GOLANG-STDCRYPTOX509-17135840
std/mime	SNYK-GOLANG-STDMIME-17135844
std/net	SNYK-GOLANG-STDNET-16535159, SNYK-GOLANG-STDNET-16535161
std/net/http	SNYK-GOLANG-STDNETHTTP-14548596, SNYK-GOLANG-STDNETHTTP-16535158, SNYK-GOLANG-STDNETHTTP-18858429
std/net/url	SNYK-GOLANG-STDNETURL-15139468, SNYK-GOLANG-STDNETURL-18858438
std/os	SNYK-GOLANG-STDOS-17905377

Skipped

None.

Verification

• go build ./..., go vet ./..., go test ./..., golangci-lint run (v2.5.0) — all pass on go1.25.13.
• CI: build (all 3 OSes), lint, docs-check, license-check, security/snyk pass. Analyze (go|actions) (CodeQL: 403 read_package on github/ccr-*-queries pack) and SonarCloud fail identically on PRs Bump Go toolchain to 1.25.12 to patch stdlib vulnerabilities #156–Fix all Snyk go.mod vulnerabilities: Go toolchain 1.26.7 + mapstructure v2.4.0 #159 and are unrelated repo config issues.

Link to Devin session: https://app.devin.ai/sessions/c0981155bb6047d1b156715008fcbace
Open in Devin Desktop: https://app.devin.ai/desktop/session/c0981155bb6047d1b156715008fcbace?variant=devin
Requested by: @shayanshafii

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE