fix: build with Go 1.26.4 to remediate stdlib vulnerabilities

[kycheng]

Bump the Go build toolchain to 1.26.4 so release binaries no longer carry Go stdlib vulnerabilities flagged by Trivy on the built Harbor images (CVE-2026-27145 crypto/x509, CVE-2026-33811/33814 net, CVE-2026-42504/42507 net/textproto, CVE-2026-39820/39823/39825/39826 net/mail+html/template, etc.; all fixed in Go 1.26.4).

Part of Harbor 2.14.3 vulnerability remediation (DEVOPS-44168).

🤖 Generated with Claude Code

[kycheng]

Why this repo only changes one place for the Go 1.26.4 bump

These three sibling PRs (trivy, harbor-scanner-trivy, goharbor-distribution) look structurally different on purpose — each repo derives its release binary Go version from a different source, so each PR touches the single knob that actually controls the compiled toolchain. They do not need to mirror each other.

• trivy / harbor-scanner-trivy: release CI uses actions/setup-go with go-version-file: go.mod (goreleaser then builds natively). So the release binary's Go version is read straight from the go.mod go directive → bumping go 1.26.2 -> 1.26.4 is the correct and sufficient change. There is no hard-coded go-version: anywhere in the release workflows.
• goharbor-distribution: old-style vendor.conf project with no go.mod; its reusable-release-alauda.yaml hard-codes setup-go go-version and builds natively via make binaries. So the workflow line is the only knob. (The GO_VERSION=1.20.10 in the Dockerfile is a different path and is not used by this release job.)

Goal: remediate Go stdlib CVEs (CVE-2026-27145 crypto/x509, CVE-2026-33811/33814 net, CVE-2026-42504/42507 net/textproto, CVE-2026-39820/39823/39825/39826, etc.) flagged by Trivy on the built Harbor images, all fixed in Go 1.26.4. Verified against the harbor-all-in-one pipeline scan (DEVOPS-44168).