v4.2.1.14

fix: upgrade Go to 1.25.14 and x/sys to 0.44.0 for CVEs (#2133)

Addresses the findings Trivy reports against bin/pulsarctl in the
sn-platform 4.0.12.3 image.

Eight of the nine are Go stdlib (CVE-2026-33818, CVE-2026-39821,
CVE-2026-46600, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859,
CVE-2026-56860, CVE-2026-56862) and come from the toolchain the binary is
built with, so every go-version pin moves from 1.25.12 to 1.25.14 along with
the go directive. The fix landed in 1.25.13; staying on the 1.25 line avoids
a language version jump.

The ninth is CVE-2026-39824, an integer overflow in NewNTUnicodeString,
fixed by x/sys 0.39.0 -> 0.44.0.

Builds clean. go vet reports one pre-existing finding in
pkg/test/pulsar/standalone_test.go that is unrelated to these upgrades.