Backport Go 1.26.10 and eMudhra CA distrust to 18.11-stable

What does this MR do and why?

Backport two changes to 18-11-stable so the built Debian and UBI images meet the required security floor:

1. Bump Go to 1.26.10 (from 1.25.11). Backport of !3193 (merged). This satisfies the required Go 1.26.10-or-1.27.3 floor and picks up the security fixes in that Go release.
2. Distrust compromised eMudhra CA certificates. Cherry-pick of !3189 (merged). Adds the four eMudhra/emSign roots, the cross-sign and the 16 impacted intermediates to hardening/ca-distrust/, plus a hardening script that drops them into the p11-kit blocklist (UBI) and the ca-distrust script that strips them from the Debian trust store and the certificates container at runtime. Background: https://unit42.paloaltonetworks.com/emudhra-certificate-compromise/

The cherry-pick applied cleanly; the net change is identical to the original MRs on the default branch.

Related https://gitlab.com/gitlab-org/release/tasks/-/work_items/28133+s

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
• The original MR has been deployed to GitLab.com (not applicable for documentation or spec changes).
• This MR has a severity label assigned (if applicable).

Note to the merge request author and maintainer

If you have questions about the patch release process, please:

• Refer to the patch release runbook for engineers and maintainers for guidance.
• Ask questions on the #releases Slack channel (internal only).