chore: update dependencies for security fixes

[EhabY]

Updates the repo to Go 1.25 and bumps the Dependabot/security-relevant Go dependencies so the combined update supersedes the open Dependabot PRs and clears current govulncheck findings.

Also updates CI to install Go 1.25 and bumps golangci-lint because the previous pinned linter does not build with the newer Go toolchain.

Closes #228
Closes #227
Closes #216
Closes #215
Closes #213
Closes #197

Dependency impact notes

• go 1.25 is a consumer-facing minimum toolchain change. Go 1.21+ treats the go directive as a strict minimum, and several upgraded dependencies now declare Go 1.25. Local contributors and downstream CI need Go 1.25+ or automatic toolchain download enabled.
• golangci-lint is now v1.64.8 so linting can run against the Go 1.25 module target. Running make lint with an older local Go toolchain may fail before linting.
• cloud.google.com/go/compute/metadata still uses the custom 3 second HTTP client in slogstackdriver.Sink. The notable behavior change is that metadata requests now retry HTTP 429, so a repeatedly rate-limited metadata service can spend more of that timeout before Stackdriver initialization falls back to an empty project ID.
• google.golang.org/grpc remains indirect through the Stackdriver logging dependencies. The repo does not create gRPC clients or servers directly, so API and runtime behavior risk is low.
• OpenTelemetry SDK usage is test-only. Runtime code stores and emits trace.SpanContext; tests cover trace and span output for entry, JSON, and Stackdriver sinks.
• golang.org/x/term is used only for term.IsTerminal, whose API remains stable. Tests cover non-terminal output and closed-file detection.
• github.com/charmbracelet/lipgloss is used for human-log styling. Automated tests cover non-color rendering; colored terminal output could still vary with Lipgloss/termenv terminal-profile internals, but no concrete output regression was found.
• golang.org/x/net is indirect through gRPC/cloud logging. The update removes HTTP/2 and related advisory exposure without direct slog API impact.
• github.com/google/go-cmp and go.uber.org/goleak are used by tests only. Normal slog behavior is unaffected.
• Go 1.20 to 1.25 language/runtime audit found no slog-specific behavior change. Checked loop variable captures, runtime.Callers caller metadata, encoding/json output, timers, sync.Map, reflect, and os.Exit; existing tests, go vet ./..., and lint passed.

govulncheck ./... reports no vulnerabilities after the update.

Generated by Coder Agents.

[coveralls]

Coverage Report for CI Build 98910

Coverage remained the same at 96.034%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	933
Covered Lines:	896
Line Coverage:	96.03%
Coverage Strength:	25.29 hits per line

---

💛 - Coveralls