Security Scan's govulncheck reports GO-2026-6603, GO-2026-6605, GO-2026-6607, GO-2026-6608 and GO-2026-6610 as called vulnerabilities in the Go standard library (net/http, net/textproto, crypto/tls). They are fixed in Go 1.26.9. Bump the go directive from 1.26.8 to 1.26.9 so the CI toolchain is at least the patched version.