chore(deps): bump Go to 1.25.9 [security] (release-2.1)

[phisco]

Description of your changes

Mirrors #961 for release-2.1, adapted for Earthly.

govulncheck reports 5 reachable stdlib vulnerabilities on this branch
with the current Go 1.24.4 toolchain:

ID	Package
GO-2026-4947	crypto/x509 (chain-building DoS)
GO-2026-4946	crypto/x509 (policy validation)
GO-2026-4870	crypto/tls (KeyUpdate DoS)
GO-2026-4865	html/template (XSS)
GO-2026-4601	net/url

Go 1.24 went end-of-life on 2026-02-10 (when 1.26.0 shipped) and did
not receive the April 2026 security batch — those fixes only landed in
1.25.9 and 1.26.2. The latest 1.24 release (1.24.13, 2026-02-04) does
not resolve these, so this PR does a minor version bump to 1.25.9
rather than a patch bump.

This differs from crossplane's release-2.1 bump
(crossplane/crossplane#7305), which was patch-level (1.25.6 → 1.25.9)
because that branch was already on the 1.25 line.

Commits

1. Bump Go to 1.25.9 to fix stdlib CVEs —
   Earthfile `GO_VERSION=1.24.4 → 1.25.9`, `go.mod` `go 1.24.0 →
   1.25.9`, and golangci-lint `v2.2.1 → v2.11.4` (v2.2.1 was built
   with Go 1.24 and refuses to lint `go 1.25.9` targets).

2. Apply golangci-lint v2.11.4 compliance fixes — bumping
   golangci-lint surfaces new checks against existing code. Resolved
   in a single pass:

   • gocritic deprecatedComment: inserts a blank line between the
     description paragraph and `// Deprecated:` notices so they form
     a dedicated paragraph.
   • godoclint package-godoc duplication: removes the duplicate
     `// Package X` comment from `event_test.go` and
     `namespaced_reference.go`; the canonical comment stays on the
     package's primary file.
   • staticcheck SA1019: adds targeted `//nolint:staticcheck`
     comments on the legitimate internal uses of the now-properly-marked
     deprecated types.
   • `golangci-lint run --fix` auto-fixes: modernises a number of
     idioms enabled by the Go 1.25 bump (`interface{}` → `any`,
     `strings.Split` → `strings.SplitSeq`, small whitespace
     adjustments). Earthfile's `+lint` target saves these back to
     the tree, so they have to land on disk or `check-diff` flags
     the difference.

Downstream impact

Bumping the `go` directive in `go.mod` to 1.25.9 forces consumers
of release-2.1 to Go ≥ 1.25. If that's too disruptive for a patch
release, we can drop the `go.mod` change (and the golangci-lint bump,
which only becomes necessary because of it); our CI binaries would
still pick up the Go fixes, but consumers would need to upgrade their
own toolchain to actually benefit.

Fixes #

I have:

• Read and followed Crossplane's contribution process.
• Run `earthly +reviewable` to ensure this PR is ready for review.
• Added or updated unit tests.
• Linked a PR or a [docs tracking issue] to [document this change].
• Added `backport release-x.y` labels to auto-backport this PR.