Fix CVE-2025-22871: Upgrade Go to v1.23.8

[chainloop-development]

Summary

Upgraded the Go toolchain from version 1.21 to 1.23.8 to address a critical HTTP request smuggling vulnerability in the net/http package.

Vulnerability Fixed

CVE-2025-22871 (CRITICAL): The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines, which can permit HTTP request smuggling when used with servers that incorrectly accept bare LF as part of chunk-ext.

Changes Made

• Updated go.mod to specify Go version 1.23.8 (from 1.21)
• This resolves the vulnerability as the fix is included in Go 1.23.8 and later versions
• The application uses net/http for its REST API server (simple-todo.go:8,40), making this vulnerability directly reachable
• No code changes required; the fix is in the Go standard library