build: move to Go 1.27.1, refresh website dependencies, fix CI gates

[szibis]

Summary

Main has been red since Go 1.26.5 picked up five stdlib advisories: every PR fails the test job on govulncheck, Security / static fails on Trivy's scan of the website lockfile, the nightly image scan fails on the same stdlib CVEs, and the changelog gate rejects every Dependabot website bump. This PR fixes all four causes in one change so the open Dependabot backlog can land and CI is green again.

What changed

Toolchain

• Go 1.26.5 → 1.27.1 in go.mod, bench/go.mod, the Docker builder image (golang:1.27.1-alpine3.24, from build(deps): bump golang from 1.26.5-alpine3.24 to 1.27.1-alpine3.24 #498) and every workflow setup-go pin.
• golangci-lint v2.11.4 → v2.13.2 — a lint binary built with Go 1.26 refuses a Go 1.27 go.mod.
• github.com/klauspost/compress 1.19.0 → 1.19.1 (from build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 in the go-minor group #485).
• GitHub Actions SHA pins, actions-minor group, 9 updates (from build(deps): bump the actions-minor group across 1 directory with 9 updates #499).

Website dependencies (website/, not shipped in the binary or chart)

• Docusaurus 3.10.0 → 3.10.2, plus a targeted refresh of postcss, fast-uri, brace-expansion, js-yaml, nanoid, browserslist, svgo, mermaid, dompurify, qs, @swc/html, baseline-browser-mapping, colord, joi, postcss-selector-parser.
• mermaid pinned to 11.x via overrides — 12.0.0 pulls a vulnerable chevrotain/lodash-es chain. qs overridden to >=6.16.0.
• gray-matter declared as a devDependency: Docusaurus 3.10.2 replaced it internally with @11ty/gray-matter, and the site config imports it directly.
• npm audit now reports only the image-size chain, which has no upstream fix.

CI gates

• Changelog gate: website/ is now a non-release path, so Dependabot website bumps and docs-site-only PRs no longer fail for a missing CHANGELOG entry. Two new unit tests.
• Dependabot: new grouped npm entry for /website (weekly, 7-day cooldown; version updates and security updates each grouped into one PR).

CHANGELOG: Security and Changed entries under [Unreleased], including the CVE mapping for the Go advisories and the rationale for the two dispositions that are not upgrades (image-size, CodeQL request-log finding).

Security advisories closed

Advisory	CVE	Package
GO-2026-6218	CVE-2026-56860	net/url
GO-2026-6090	CVE-2026-56862	crypto/tls
GO-2026-6089	CVE-2026-56853	net/http
GO-2026-5972	CVE-2026-33818	encoding/asn1
GO-2026-5026	CVE-2026-39821	golang.org/x/net/idna

Plus the 16 Trivy image findings on stdlib (the CVEs above and CVE-2026-46600, CVE-2026-56858, CVE-2026-56859) and 33 of the 35 open Dependabot npm advisories.

Verification (local, Go 1.27.1)

Check	Result
go build ./..., go vet ./..., gofmt -s -l	clean
go test ./...	all packages pass
golangci-lint run (v2.13.2)	0 issues
govulncheck ./...	no vulnerabilities
Trivy fs with the CI arguments	0 findings (go.mod, bench/go.mod, website/package-lock.json)
docker build + Trivy image	0 findings in loki-vl-proxy and healthcheck binaries and the base layer
npm run typecheck, npm run build	pass
scripts/ci/tests/test_check_changelog_pr.py	22 pass
scripts/ci/check_changelog_pr.py --base main --head HEAD	ok

Supersedes

Folded in as cherry-picks: #485, #498, #499.
Superseded by the website refresh (Dependabot will close these once this merges): #484, #488, #489, #490, #491, #492, #496, #497, #500, #501, #502, #503, #504, #505.

[github-actions]

PR Quality Report

Compared against base branch main.

Coverage and tests

Signal	Base	PR	Delta
Test count	4795	4795	0
Coverage	89.1%	89.1%	0.0% (stable)

Compatibility

Track	Base	PR	Delta
Loki API	100.0%	11/11 (100.0%)	0.0% (stable)
Logs Drilldown	100.0%	17/17 (100.0%)	0.0% (stable)
VictoriaLogs	100.0%	11/11 (100.0%)	0.0% (stable)

Performance smoke

Lower CPU cost (ns/op) is better. Lower benchmark memory cost (B/op, allocs/op) is better. Higher throughput is better. Lower load-test memory growth is better. Benchmark rows are medians from repeated samples.

Signal	Base	PR	Delta
QueryRange cache-hit CPU cost	2873.0 ns/op	2904.0 ns/op	+1.1% (stable)
QueryRange cache-hit memory	1184.0 B/op	1184.0 B/op	0.0% (stable)
QueryRange cache-hit allocations	29.0 allocs/op	29.0 allocs/op	0.0% (stable)
QueryRange cache-bypass CPU cost	3150.0 ns/op	3173.0 ns/op	+0.7% (stable)
QueryRange cache-bypass memory	1245.0 B/op	1245.0 B/op	0.0% (stable)
QueryRange cache-bypass allocations	30.0 allocs/op	30.0 allocs/op	0.0% (stable)
Labels cache-hit CPU cost	670.8 ns/op	665.2 ns/op	-0.8% (stable)
Labels cache-hit memory	48.0 B/op	48.0 B/op	0.0% (stable)
Labels cache-hit allocations	3.0 allocs/op	3.0 allocs/op	0.0% (stable)
Labels cache-bypass CPU cost	1152.0 ns/op	1171.0 ns/op	+1.6% (stable)
Labels cache-bypass memory	391.0 B/op	391.0 B/op	0.0% (stable)
Labels cache-bypass allocations	14.0 allocs/op	14.0 allocs/op	0.0% (stable)

State

• Coverage, compatibility, and sampled performance are reported here from the same PR workflow.
• This is a delta report, not a release gate by itself. Required checks still decide merge safety.
• Performance is a smoke comparison, not a full benchmark lab run.
• Delta states use the same noise guards as the quality gate (percent + absolute + low-baseline checks), so report labels match merge-gate behavior.