fix(deps): bump Go to 1.27.2 and golang.org/x/net to v0.60.0

Note

Why main went red: this was triggered by an update to the Go vulnerability database, not by a code change. The DB update published 2026-10-08 22:31 UTC added these advisories. The last passing govulncheck on main (https://gitlab.com/gitlab-org/cli/-/jobs/17045688644, 22:52 UTC on 4c1c19041) still scanned against the 2026-10-07 DB copy. The first failure (https://gitlab.com/gitlab-org/cli/-/jobs/17047120506, 00:44 UTC on fb77ff921) used the new one. The only commit between them doesn't touch dependencies. Re-running govulncheck on 4c1c19041 with the current DB reports the same 10 advisories.

What does this MR do?

Fixes the failing govulncheck job on main (https://gitlab.com/gitlab-org/cli/-/jobs/17047120506). The 2026-10-08 Go vuln DB update added 10 reachable advisories:

Advisory	Area	Fixed in
GO-2026-6603, 6610, 6611, 6612, 6617	HTTP/2 (net/http internal + x/net/http2)	go1.27.2, x/net v0.60.0
GO-2026-6605, 6613	HTTP/1 CONNECT desync (net/http)	go1.27.2
GO-2026-6607	ECH extension validation (crypto/tls)	go1.27.2
GO-2026-6608	MIME header memory limit (net/textproto)	go1.27.2
GO-2026-6604	os.Root junction escape (Windows)	go1.27.2

Bumps the Go version in .gitlab-ci.yml, .tool-versions, go.mod, and golang.org/x/net to v0.60.0. Local govulncheck ./... now reports 0 reachable vulnerabilities.

The build_test and release jobs now pass GOTOOLCHAIN=go$GO_VERSION to the goreleaser container. goreleaser/goreleaser:nightly still ships Go 1.27.1 with GOTOOLCHAIN=local. Without this, it rejects the go 1.27.2 directive and fails the build. Pinning also means release binaries always use our GO_VERSION, not whatever Go the nightly image ships.

Also drops the stale tool version list from the comment in .gitlab/duo/agent-config.yml; .tool-versions is the source of truth.

🤖 Generated with Claude Code