[master] update to go1.23.8 (fix CVE-2025-22871)

[thaJeztah]

full diff: golang/go@go1.23.7...go1.23.8
release notes: https://go.dev/doc/devel/release#go1.24.2

go1.23.8 (released 2025-04-01) includes security fixes to the net/http package, as well as bug fixes to the runtime and the go command. See the Go 1.23.8 milestone on our issue tracker for details;

https://github.com/golang/go/issues?q=milestone%3AGo1.23.8+label%3ACherryPickApproved

From the mailing list:

Hello gophers,

We have just released Go versions 1.24.2 and 1.23.8, minor point releases. These minor releases include 1 security fixes following the security policy:

• net/http: request smuggling through invalid chunked data The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permit request smuggling. The net/http package now rejects chunk-size lines containing a bare LF. Thanks to Jeppe Bonde Weikop for reporting this issue. This is CVE-2025-22871 and Go issue https://go.dev/issue/71988.

- What I did

- How I did it

- How to verify it

- Description for the changelog

Update Go runtime to [1.23.8](https://go.dev/doc/devel/release#go1.23.8).

- A picture of a cute animal (not mandatory but encouraged)