Bump Go to 1.24.12+ to fix CVE-2025-61726, CVE-2025-61728, CVE-2025-61729

[vdemeester]

Summary

Go 1.24.12 fixes three CVEs affecting tkn:

• CVE-2025-61726: Memory exhaustion in net/url query parameter parsing
• CVE-2025-61728: Excessive CPU consumption in archive/zip index building
• CVE-2025-61729: Resource exhaustion in crypto/x509 certificate validation

Current State

• main: Go 1.24.6
• release-v0.42.0: Go 1.24.3
• release-v0.37.2: Go 1.23.0

Required

Bump to Go 1.24.12+ on main and backport to active release branches.

References

• https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
• net/http: memory exhaustion in Request.ParseForm (CVE-2025-61726) golang/go#77101
• archive/zip: denial of service when parsing arbitrary ZIP archives (CVE-2025-61728) golang/go#77102
• https://pkg.go.dev/vuln/GO-2025-4155