Fix CVE-2025-61726: Upgrade Go to 1.24.12

[chainloop-development]

Summary

Upgraded the Go toolchain from 1.21 to 1.24.12 to remediate CVE-2025-61726, a high-severity denial-of-service vulnerability in the net/url package.

Vulnerability Fixed

CVE-2025-61726 (HIGH): The net/url package does not limit the number of query parameters parsed by net/http.Request.ParseForm(), allowing attackers to craft requests with excessive query parameters that cause unbounded memory allocation and denial of service.

Changes Made

• Updated go.mod to specify Go version 1.24.12, which includes the security fix for CVE-2025-61726
• The vulnerable code paths at simple-todo.go:78 and simple-todo.go:94 (r.FormValue() calls that internally invoke ParseForm()) are now protected by the patched Go standard library
• No application code changes required; the fix is entirely in the Go runtime