sec(deps): bump the build toolchain to go1.26.6 (backend#1972)

[LukasWodka]

govulncheck reports four CALLED stdlib vulnerabilities on go1.26.5 — reached
from this module's own code, not merely present in the dependency graph:

GO-2026-6218 net/url quadratic complexity in resolvePath
GO-2026-6090 crypto/tls post-handshake message flood
GO-2026-5972 encoding/asn1 unbounded recursion depth
GO-2026-5026 net/http x/net/idna Punycode label handling

All four are fixed in go1.26.6, and none needs a code or dependency change.
Every workflow resolves Go through go-version-file: go.mod, so this one line
moves build.yml, golangci.yml, e2e.yml, mutation.yml, release.yml and
chart-drift.yml together.

go 1.26.0 is deliberately untouched — that is the language floor, not the
toolchain, and .golangci.yml's go: "1.26" tracks it. Only the compiler moves.

Evidence, on a real toolchain rather than from release notes

GOTOOLCHAIN=auto fetched go1.26.6 and used it:

go version                 go1.26.6 darwin/amd64  (downloaded on demand)
go build ./...             exit 0
go vet ./...               exit 0
go test ./...              exit 0  (all packages ok)
govulncheck ./...          exit 0  "No vulnerabilities found."

Counterfactual, so the bump is demonstrably what fixed it rather than something
incidental — reverted the single line and re-ran the same binary:

toolchain go1.26.5  ->  exit 3, 4 vulnerabilities (the four above)
toolchain go1.26.6  ->  exit 0, none

Exit codes read explicitly: govulncheck exits 3 on findings, so "looks clean"
in the output is not the same as passing.

What is NOT in this PR

Making govulncheck a required status check. It is red-on-main today and the
prod promotion merged straight past it, which is the actual defect — filed as
backend#1972. It must be armed only AFTER this reaches main: adding the
context while main is still on go1.26.5 would block every release-train
promotion on the branch the train has to merge into.

Fix first, arm second.

---

Note

Low Risk
Toolchain-only security patch with no logic or dependency changes; low blast radius beyond build/reproducibility.

Overview
Pins the Go build toolchain to go1.26.6 (from go1.26.5) and bumps VERSION to 0.10.7. The language floor go 1.26.0 is unchanged.

This addresses four stdlib issues that govulncheck reports as reachable from this module (crypto/tls, encoding/asn1, net/http, net/url) with no application or dependency edits—CI and release builds already take Go from go-version-file: go.mod, so the toolchain line updates build, lint, e2e, mutation, release, and chart-drift workflows together.

go.mod comments document the CVEs, call paths, and that making govulncheck a required check is intentionally deferred until after this lands on main (backend#1972).

^{Reviewed by Cursor Bugbot for commit 528ddfb. Bugbot is set up for automated code reviews on this repo. Configure here.}