fix(deps): bump Go to 1.26.4 and x/net to v0.55.0 to close OSV advisories - #2852

#3019)

## What this PR does

Restores the OpenSSF Scorecard **Vulnerabilities** check to green. It
regressed to **0/10** after #2852: in the weeks since,
`golang.org/x/crypto v0.51.0` accrued **13 new advisories**
(`GO-2026-5005`, `5006`, `5013`–`5021`, `5023`, `5033`). An
`osv-scanner` pass over `main` confirmed all 13 trace to that single
package.

### Change

- **`golang.org/x/crypto 0.51.0 → 0.52.0`** (the fixed version for all
13). No transitive cascade — `go mod tidy` changed only this line plus
its two `go.sum` hashes.

Bumped with `go get` / `go mod tidy`, not by hand-editing the generated
`go.mod`.

### Verification

- `osv-scanner` after the bump: **No issues found** (0 advisories across
both modules).
- `go build ./...` passes.
- `make generate` produces **no drift** — `codegen-drift` stays green.

> Scorecard's report mentioned advisory IDs as low as `GO-2025-3512`
(kubevirt-csi, CVE-2024-1725). That package is **not** in `go.mod` or
`go.sum` — it isn't a cozystack dependency, so nothing to bump there.
The real cluster is the 13 x/crypto advisories this PR closes.

### Why this keeps happening (and the durable fix)

`x/crypto` is an **indirect** dependency, and the Renovate app isn't
actually opening PRs on this repo yet (no `renovate[bot]` PRs, no
Dependency Dashboard) — the org Renovate install needs
`cozystack/cozystack` added to its repo list. Until then, indirect-dep
and Go-toolchain advisories will keep knocking this check back to 0 and
need manual bumps like this one. Recommended follow-ups: enable Renovate
on the repo, and allow it to bump indirect deps (and optionally the Go
patch version).

### Release note

```release-note
fix(deps): bump golang.org/x/crypto to v0.52.0, closing 13 known OSV advisories (GO-2026-5005…5033)
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated cryptographic dependency to the latest patch version for
enhanced security and stability.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Restores the OpenSSF Scorecard Vulnerabilities check to green. It
regressed to 0/10 after cozystack#2852 because golang.org/x/crypto v0.51.0 accrued
13 new advisories (GO-2026-5005, 5006, 5013-5021, 5023, 5033). osv-scanner
confirms all 13 trace to that one indirect package; v0.52.0 is the fixed
version. go mod tidy changed only this line and its two go.sum hashes.

After the bump osv-scanner reports no issues, both modules build, and
'make generate' produces no drift. Versions were changed with go get /
go mod tidy, not by hand-editing the generated go.mod.

Signed-off-by: Myasnikov Daniil <[email protected]>
Assisted-By: Claude <[email protected]>

…#2941)

## What this PR does

Completes the Go-toolchain modernization for first-party images — the
build-time counterpart to #2852, which raised the root and `api/`
modules to Go 1.26.4.

1. **First-party image Go modules → go 1.26.4** (`token-proxy`,
`kube-ovn-webhook`, `kubevirt-csi-driver`): raise the `go` directive and
refresh dependencies. `kube-ovn-webhook` moves `k8s.io/*` 0.26 → 0.36.2
(only long-stable admission/core API is used); `kubevirt-csi-driver`
keeps its existing replace-based k8s alignment at 0.36.0 (main's
refactor owns that module's pin) and raises the `go` directive, with the
`golang.org/x/net` 0.56.0 security bump — which clears the reachable
GO-2026-5026 — reapplied. Adds two `.gitignore` files so the
locally-built binaries can't be committed.
2. **Go builder images → `golang:1.26`** across 8 images still on
EOL/behind toolchains (golang 1.20, 1.20.6, 1.23.4, 1.24, 1.25):
`cluster-autoscaler`, `kubevirt-cloud-provider`, `redis-operator`,
`multus-cni`, `keycloak-operator`, `objectstorage`, `kilo`,
`linstor-csi`. The builder image tag — not the go.mod minimum — sets the
standard-library version baked into the binary, so these still shipped
unpatched stdlib on a plain rebuild.

Verified: `GOOS=linux go build`/`go vet` pass for all three modules and
`go mod tidy` is a no-op; the three biggest builder jumps
(redis-operator, kubevirt-cloud-provider, cluster-autoscaler — all
formerly Go 1.20.x/1.23.x) were verified with a local `docker build`;
the remaining five (1.24/1.25 → 1.26) are covered by CI image builds.

### Release note

```release-note
chore(platform): raise the Go toolchain to 1.26 across first-party images to clear standard-library security advisories
```


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Updated several container build environments to a newer Go release for
consistency across Kubernetes-related components.
* Refreshed module and dependency versions in a few services to keep
builds current.
* Expanded ignore rules for generated image artifacts so build outputs
aren’t tracked.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->