fix: upgrade Go toolchain to 1.27.2 to resolve GO-2026-6603-stdlib

[chainloop-platform]

Summary

Upgraded the root module Go toolchain from 1.27.1 to 1.27.2 so builds use the first patched stdlib release for GO-2026-6603-stdlib. This removes the vulnerable net/http HTTP/2 server implementation from the project toolchain while keeping the change scoped to the root manifest.

Vulnerability Fixed

GO-2026-6603-stdlib (HIGH): When a Go net/http HTTP/2 server processes a client Trailer header declaring many fields, it can allocate disproportionate memory and bypass normal header limits, enabling denial of service.

Changes Made

• Updated go.mod from go 1.27.1 to go 1.27.2, matching the first patched Go stdlib release identified in the assessment.
• Kept the remediation limited to the root module toolchain declaration so downstream dependency state and application behavior remain unchanged apart from the patched stdlib version.

Verification

Ran syft dir:. -o cyclonedx-json=sbom.json && grype sbom:sbom.json --only-fixed -o json against the patched repository root. Outcome: resolved — grype confirms GO-2026-6603-stdlib is no longer present in the generated SBOM for the patched source tree.

Risk Assessment

View the risk assessment in Chainloop

[chainloop-platform]

AI Session Checks — ⏭️ bypassed by label

AI Coding Session Check Bypassed

This PR carries the skip-ai-session label, so the AI coding session check was bypassed.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace

[chainloop-eng]

Closing: main already has this change, from the merge of #3608. 🤖 Posted by chainloop-eng (eng-autopilot) for @migmartri