[release-8.5] deps: fix Go stdlib security issues

[yibin87]

close: #330

Summary

• backport the Go stdlib security fix from deps: fix Go stdlib security issues #331 to release-8.5
• bump Go from 1.25.6 to 1.25.7 for the stdlib CVEs reported in issue Outdated third-party dependencies need to be upgraded. #330
• revert the previous VictoriaMetrics upgrade and related compatibility changes
• keep github.com/pingcap/tidb unchanged because the current release-8.5 base is already on a much newer pseudo-version than the vulnerable 20240409 build from the issue report

Verification

• go test ./component/conprof/store -count=1 -json
• go test ./... was rerun multiple times; one package (component/conprof/store) showed intermittent failures and also passed on targeted rerun

Mainline PR: #331

[ti-chi-bot]

This cherry pick PR is for a release branch and has not yet been approved by triage owners.
Adding the do-not-merge/cherry-pick-not-approved label.

To merge this cherry pick:

1. It must be LGTMed and approved by the reviewers firstly.
2. For pull requests to TiDB-x branches, it must have no failed tests.
3. AFTER it has lgtm and approved labels, please wait for the cherry-pick merging approval from triage owners.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: zimulala

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [zimulala]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-03-16 08:09:17.605020954 +0000 UTC m=+171684.692678491: ☑️ agreed by zimulala.