fix(security): upgrade Go to 1.25.6 to address archive/zip CVE (#698)

Upgrades Go from 1.25.5 to 1.25.6 to fix the security vulnerability
in the archive/zip package that could cause excessive CPU consumption
when building archive index (CVE in golang stdlib).

Changes:
- Update go.mod to require Go 1.25.6
- Update Dockerfile base images from golang:1.25-alpine3.21 to
  golang:1.25.6-alpine3.22 (alpine3.21 not available for Go 1.25.6)
- Update dockerfiles/Dockerfile.cloud similarly

Co-authored-by: Michael Guarino <mjg@plural.sh>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: 3 people

Dockerfile

@@ -3,7 +3,7 @@ FROM ubuntu:22.10 AS user
 # Create a nonroot user for final image
 RUN useradd -u 10001 nonroot
 
-FROM golang:1.25-alpine3.21 AS builder
+FROM golang:1.25.6-alpine3.22 AS builder
 
 WORKDIR /workspace
 
@@ -31,7 +31,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
     -X "github.com/pluralsh/plural-cli/pkg/common.Date=${APP_DATE}"' \
     -o plural ./cmd/plural
 
-FROM golang:1.25-alpine3.21 AS final
+FROM golang:1.25.6-alpine3.22 AS final
 
 WORKDIR /
 

dockerfiles/Dockerfile.cloud

@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine3.21 AS builder
+FROM golang:1.25.6-alpine3.22 AS builder
 
 WORKDIR /workspace
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/pluralsh/plural-cli
 
-go 1.25.5
+go 1.25.6
 
 require (
 	cloud.google.com/go/compute v1.49.1