Release binaries embed Go 1.26.6 stdlib with known DoS CVEs (CVE-2026-78667, CVE-2026-78669, CVE-2026-97031) #406

The release binaries are built with the Go toolchain resolved from go.mod (your shared powerman/workflows build.yml uses actions/setup-go with go-version-file: 'go.mod'), so v0.25.2 ships with the Go 1.26.6 stdlib (go version -m on the released dockerize-v0.25.2-linux-amd64 -> go1.26.6).

That stdlib is affected by three HIGH DoS issues, all fixed in 1.26.9 / 1.27.2:

• CVE-2026-78667 - net/http: Denial of Service via crafted HTTP Range headers
• CVE-2026-78669 - net/http/internal/http2: Denial of Service via excessive HTTP/2 SETTINGS
• CVE-2026-97031 - crypto/tls: Denial of Service via multiple ECH outer extension references

dockerize only makes outbound connections, so the real-world exposure is low, but it ships inside container images that are vulnerability-scanned (we scan our foreman-proxy images with Trivy, --exit-code 1 on HIGH): the release binaries fail such scans until a release embeds a fixed stdlib.

Ask: bump the go directive in go.mod to 1.27.2 for the next release. I opened PR #399 with the one-line change.

Context: we build foreman-proxy container images (gitlab.com/6admin.io/docker/foreman) that use dockerize for template rendering; the scan gate is why this matters to us.