fix: update Go to 1.24.11 to fix stdlib security vulnerabilities (#3059)

Addresses Go stdlib CVEs:
- CVE-2025-61724 (net/textproto) - fixed in Go 1.24.8
- CVE-2025-58189 (crypto/tls) - fixed in Go 1.24.8
- CVE-2025-58185 (encoding/asn1) - fixed in Go 1.24.8
- CVE-2025-61723 (encoding/pem) - fixed in Go 1.24.8
- CVE-2025-47912 (net/url) - fixed in Go 1.24.8
- GO-2025-4175 (crypto/x509) - fixed in Go 1.24.11
- GO-2025-4155 (crypto/x509) - fixed in Go 1.24.11
- GO-2025-4007 (crypto/x509) - fixed in Go 1.24.9

Also adds:
- golang version to .tool-versions for asdf users
- scripts/check-go-vulnerabilities.sh for local vulnerability scanning

Closes #3036, #3037, #3038, #3039, #3040

Author: rossnelson

.tool-versions

@@ -1 +1,2 @@
 pnpm 8.15.7
+golang 1.24.11

scripts/check-go-vulnerabilities.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+set -e
+
+# Check Go vulnerabilities using govulncheck
+# Requires govulncheck: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+GO_MOD_PATH="${1:-server}"
+
+if [[ ! -d "$GO_MOD_PATH" ]]; then
+  echo "Error: directory not found at $GO_MOD_PATH"
+  exit 1
+fi
+
+if ! command -v govulncheck &> /dev/null; then
+  echo "Installing govulncheck..."
+  go install golang.org/x/vuln/cmd/govulncheck@latest
+fi
+
+echo "Checking Go vulnerabilities in $GO_MOD_PATH"
+echo "================================================================"
+
+cd "$GO_MOD_PATH"
+
+GO_VERSION=$(grep "^go " go.mod | awk '{print $2}')
+echo "Go version: $GO_VERSION"
+echo ""
+
+govulncheck -json ./... 2>&1 || true

server/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine3.22 AS server-builder
+FROM golang:1.24.11-alpine3.22 AS server-builder
 
 RUN apk upgrade --no-cache && \
     apk add --no-cache \
@@ -15,7 +15,7 @@ COPY . ./
 
 RUN make build-server
 
-FROM golang:1.24-alpine3.22 AS dockerize-builder
+FROM golang:1.24.11-alpine3.22 AS dockerize-builder
 
 ARG DOCKERIZE_VERSION=v0.9.2
 RUN go install github.com/jwilder/dockerize@${DOCKERIZE_VERSION} && \

server/go.mod

@@ -1,6 +1,6 @@
 module github.com/temporalio/ui-server/v2
 
-go 1.24.0
+go 1.24.11
 
 require (
 	github.com/Masterminds/sprig/v3 v3.3.0