chore(deps): update go module directive to v1.26.6

[scality-renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
go (source)	golang	minor	1.25.6 → 1.26.6	1.27.0 (+1)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[scality-renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[github-actions]

Dependency Bump Evaluation

Version change: Go 1.25.6 → 1.26.6 (minor)
Semver bump type: minor (Go toolchain)

Changes:

• Go 1.26 is a significant language release with new features (new() accepts expressions, self-referential generic constraints), removed tools (cmd/doc deleted), and behavioral changes
• Post-quantum key exchanges (SecP256r1MLKEM768, SecP384r1MLKEM1024) enabled by default in crypto/tls
• crypto random parameters now ignored in key generation functions (always uses secure internal source)
• net/url.Parse now rejects URLs with colons in host subcomponent
• net/http.ServeMux trailing slash redirects changed from 301 to 307
• Green Tea GC enabled by default (10-40% reduction in GC overhead)
• image/jpeg encoder/decoder replaced (different bit-for-bit output)
• PKCS#1 v1.5 encryption padding deprecated in crypto/rsa
• ReverseProxy.Director deprecated in net/http/httputil

Breaking changes: Multiple behavioral changes in Go 1.26, but none directly affect this codebase's source code. See impact analysis below.

Security concerns: None. Post-quantum key exchanges are enabled by default in TLS, which is a security improvement. The codebase uses TLS in cmd/main.go and internal/webhook/v1alpha1/webhook_suite_test.go but neither constrains CurvePreferences, so the new defaults apply transparently. No deprecated crypto APIs are used.

Impact on codebase:

• Searched for all 10 Go 1.26 breaking change patterns across the codebase
• 9/10 patterns: no matches found (no usage of deprecated crypto APIs, ReverseProxy.Director, url.Parse with colons, image/jpeg, cmd/doc, http.Client cookies, ServeMux redirects, or crypto random sources)
• 1/10 patterns: TLS configuration in cmd/main.go (lines 77, 117-119, 146, 195) and webhook_suite_test.go (line 129) will inherit post-quantum key exchange defaults — low risk, Go negotiates gracefully with fallback

Recommendation: REVIEW REQUIRED

Notes:

1. CI lint is failing: golangci-lint v2.5.0 was built with Go 1.25 and cannot target Go 1.26.6. Error: can't load config: the Go language version (go1.25) used to build golangci-lint is lower than the targeted Go version (1.26.6). The golangci-lint version in CI needs to be updated to one built with Go 1.26+ before this PR can merge.
2. Build and test checks are still in progress — wait for them to complete before merging.
3. While the source code impact is minimal, Go minor version bumps can affect dependency compilation and runtime behavior. Verify that all dependencies compile cleanly with Go 1.26.
4. A pending Go 1.27.0 release is available — consider whether to wait or bump incrementally.

— Claude Code