Fix govulncheck version to toolchain version

[emcfarlane]

The govulncheck build uses the go.mod version. This fails when using a go toolchain version greater the the go.mod version with specific language features. Switch to using go env GOVERSION to ensure it's built to match the toolchain.

The error seen in buf:

  govulncheck with the current Go version.


  There are errors with the provided package patterns:

  /opt/homebrew/Cellar/go/1.26.0/libexec/src/vendor/golang.org/x/crypto/chacha20poly1305/fips140only_go1.26.go:7:9: file requires newer Go version go1.26 (application built with
  go1.25)
  -: This application uses version go1.25 of the source-processing packages but runs version go1.26 of 'go list'. It may fail to process source files that rely on newer language
  features. If so, rebuild the application using a newer version of Go.
  /Users/edward/.cache/buf/Darwin/arm64/go/pkg/mod/golang.org/x/crypto@v0.48.0/chacha20poly1305/fips140only_go1.26.go:7:9: file requires newer Go version go1.26 (application
  built with go1.25)
  -: This application uses version go1.25 of the source-processing packages but runs version go1.26 of 'go list'. It may fail to process source files that rely on newer language
  features. If so, rebuild the application using a newer version of Go.

[stefanvanburen]

seems reasonable; there's no equivalent go list -m -f {{.GoToolchainVersion}} template? (should we update the comment as to why this is different from the other targets with a similar _GO_VERSION var?)

[emcfarlane]

@stefanvanburen updated doc