Fix CVE-2025-61726: Upgrade Go to 1.23.6

[chainloop-development]

Summary

Upgraded Go from version 1.21 to 1.23.6 to remediate CVE-2025-61726, a high-severity vulnerability in the net/url package's form parsing.

Vulnerability Fixed

CVE-2025-61726 (HIGH): The net/url package does not set a limit on the number of query parameters in a query. Parsing large forms containing many unique query parameters can cause excessive memory consumption, enabling denial-of-service attacks.

Changes Made

• Updated go.mod to use Go 1.23.6, which includes the fix for CVE-2025-61726
• This addresses the vulnerable code paths in simple-todo.go:78 and simple-todo.go:94 where FormValue() internally invokes the vulnerable ParseForm() method
• The upgrade prevents attackers from triggering excessive memory consumption by sending maliciously crafted requests with thousands of unique form parameters