Update GitLab Elasticsearch Indexer to 5.14.13

🤖 AI-authored change.

What does this MR do and why?

Pins GITLAB_ELASTICSEARCH_INDEXER_VERSION 5.14.7 -> 5.14.13 on 18-11-stable-ee, bringing the ICU charset-conversion fix to 18.11.

5.14.14 would be preferable — it is what master, 19.4, 19.2 and 19.1 took (!255991 (merged)) and it carries the same ICU fix without rolling jackc/pgx/v5 back to 5.8.0, below the 5.9.0 fixed line for CVE-2026-33816. It does not build on this lane. Pushed here, its CNG job failed with go: go.mod requires go >= 1.26.0 (running go 1.25.11; GOTOOLCHAIN=local) (https://gitlab.com/gitlab-org/build/CNG-mirror/-/jobs/16553620167). v5.14.13 keeps go 1.25.0.

Raising CNG's GO_VERSION on 18-11-stable is the prerequisite for 5.14.14 here; until then this lane accepts the pgx rollback.

MR acceptance checklist

• This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
• The fix has been deployed to GitLab.com.
• The MR title is descriptive.
• Required labels have been applied to this merge request
  • severity label and bug subtype labels (if applicable)
  • If this MR fixes a bug that affects customers, the customer label has been applied.
• This MR has been approved by a maintainer (only one approval is required).
• Ensure the e2e:test-on-omnibus-ee job has succeeded, or if it has failed, investigate the failures.

---

🤖 Automated change — mention me to get a response. Feedback welcome. Ask to speak to John directly anytime.

Mechanism, citations and verification (for agents / deep readers)

Mechanism

GITLAB_ELASTICSEARCH_INDEXER_VERSION:1 goes 5.14.7 -> 5.14.13. Omnibus and CNG read this file to resolve the indexer ref.

Verification

Lineage, in a clone of gitlab-org/gitlab-elasticsearch-indexer:

• git merge-base --is-ancestor v5.14.7 v5.14.13 exits 0 — a fast-forward from the current pin.
• v5.14.13 is not an ancestor of v5.14.14; they share cce30fde. v5.14.7 is an ancestor of both.
• go.mod: v5.14.13 = go 1.25.0, pgx/v5 v5.8.0; v5.14.14 = go 1.26.0, pgx/v5 v5.10.0.
• third_party/icu/convert.go and c_bridge.c hash identically at both tags.

Build constraint, measured rather than reasoned:

• CNG gitlab-elasticsearch-indexer/Dockerfile contains ENV GOTOOLCHAIN=local on master and on every stable branch checked.
• CNG ci_files/variables.yml GO_VERSION: master and 19-4/19-3/19-2 1.26.7; 19-1 1.25.14; 19-0 and 18-11 1.25.11.
• Omnibus's config/software/gitlab-elasticsearch-indexer.rb sets no GOTOOLCHAIN — the constraint is CNG's, not omnibus's.

What I did not verify

• No omnibus package build or QA run on this lane.
• Whether the pgx 5.8.0 exposure is reachable in indexer code paths on this lane.
• Whether 18.11 is in scope for the patch release is the release managers' call.