fix: upgrade Go toolchain to 1.27.2 for GO-2026-6607-stdlib

[chainloop-platform]

Summary

Upgraded the repository Go toolchain pin and goreleaser builder images from 1.27.1 to 1.27.2 so builds use the patched stdlib release that fixes the crypto/tls ECH parsing denial-of-service issue.

Vulnerability Fixed

GO-2026-6607-stdlib (HIGH): malformed TLS ClientHello messages with multiple ECH outer extension references could trigger memory exhaustion in Go's crypto/tls server-side parser.

Changes Made

• Updated go.mod from go 1.27.1 to go 1.27.2 so the repository targets the patched Go stdlib release.
• Updated goreleaser builder images in app/controlplane/Dockerfile.goreleaser, app/artifact-cas/Dockerfile.goreleaser, and app/cli/Dockerfile.goreleaser from golang:1.27.1 to the pinned golang:1.27.2@sha256:2d658507a011f1eadc0114d7a421b312b2e77d9042a24036a26e267cc9231677 image.
• Kept the fix scoped to version pins only; no application code changes were required for this stdlib vulnerability.

Verification

Ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json against the patched repository. Outcome: resolved — grype no longer reports GO-2026-6607-stdlib in the generated SBOM for repo/.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⏭️ bypassed by label

AI Coding Session Check Bypassed

This PR carries the skip-ai-session label, so the AI coding session check was bypassed.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace

[chainloop-eng]

🤖 Posted by chainloop-eng (eng-autopilot) for @migmartri