security: upgrade golang to 1.25.6 to fix CVE-2025-61729

[menahyouyeah]

Description

This PR upgrades the Go toolchain and base images to version 1.25.6.

Why is this needed?

This update addresses CVE-2025-61729, a high-severity vulnerability in crypto/x509 that allows for potential Denial of Service (DoS) via resource exhaustion when processing malicious certificates.

Changes

• Updated go.mod to go 1.25
• Ran go mod tidy to refresh dependencies

[netlify]

✅ Deploy Preview for kptdocs ready!

Name	Link
🔨 Latest commit	feaca8e
🔍 Latest deploy log	https://app.netlify.com/projects/kptdocs/deploys/69723942432adf0008dd6f56
😎 Deploy Preview	https://deploy-preview-4358--kptdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[efiacor]

It might be good to bump the version in the .github workflows also.
ie.

with:
go-version: '>=1.24'

[menahyouyeah]

It might be good to bump the version in the .github workflows also. ie.

with: go-version: '>=1.24'

Updated the workflows. Since I bumped the go.mod to 1.25.6, the default GitHub runners (which often lag by a patch version or two, currently at 1.25.5) were failing because they couldn't satisfy the strict version check under GOTOOLCHAIN=local. So I updated to 1.25.6 specifically in a few places.

[efiacor]

Can we go with the following for all workflows?

name: Set up Go
uses: actions/setup-go@v6
with:
go-version-file: go/src/github.com/kptdev/kpt/go.mod
cache: true

the check-latest is redundant if cache=true

[liamfallon]

See also:
#4364
kptdev/krm-functions-sdk#748
kptdev/krm-functions-catalog#1214

[menahyouyeah]

Can we go with the following for all workflows?

name: Set up Go uses: actions/setup-go@v6 with: go-version-file: go/src/github.com/kptdev/kpt/go.mod cache: true

the check-latest is redundant if cache=true

yep done thanks for the feedback