Upgrade Go builder toolchain in Dockerfile (fixes stdlib CVE-2025-68121 and HTTP/2 DoS)

[upmcplanetracker]

The current container image is built with Go 1.23.12, which bakes known runtime security flaws into the application binary.

Because web-facing applications are frequently deployed on public ports or accidentally exposed to the wider internet by non-technical users without dedicated firewall rules runtime server stability and certificate handling are important. Rebuilding the release image using Go 1.25.7+ or 1.26.0+ is necessary to patch these issues.

Component	CVE	Severity	Threat / Impact
crypto/tls	CVE-2025-68121	CRITICAL	Incorrect certificate validation during TLS session resumption
net/http/internal/http2	CVE-2026-33814	HIGH	Denial of Service via malformed HTTP/2 SETTINGS frames
net/http	CVE-2026-56853	HIGH	Unencrypted HTTP/2 connection preface Denial of Service
html/template	CVE-2026-56858	HIGH	Cross-Site Scripting (XSS) via pathological template input
net/url	CVE-2025-61726	HIGH	Memory exhaustion / DoS via query parameter parsing

• Remote Application DoS: CVE-2026-33814 and CVE-2026-56853 allow unauthenticated actors over the internet to send malformed HTTP/2 frames, forcing the Go web server process into high CPU spikes or crash loops.
• Defense-in-Depth for Internet-Exposed Hosts: Many self-hosters deploy containerized web apps directly to the public web (or expose ports without a reverse proxy). Standard library HTTP/TLS fixes ensure the application binary remains resilient against public exploit scripts.

update the base builder image in the Dockerfile from golang:1.23 to golang:1.25-alpine (or golang:1.26-alpine) and then you should be good to go security wise (until they find something else to exploit...)