chore(deps): bump Go to 1.26.3

Patches stdlib CVEs reachable from current code:
- GO-2026-4982, GO-2026-4980: html/template escaper bypass XSS
  (renderConsent in handlers/consent.go)
- GO-2026-4976: net/http/httputil ReverseProxy query-param forwarding
- GO-2026-4971: net Dial NUL-byte panic (Windows)
- GO-2026-4918: net/http HTTP/2 SETTINGS_MAX_FRAME_SIZE infinite loop

Dockerfile builder digest refreshed to a 1.26-alpine image that
resolves to 1.26.3.

Author: babs

Dockerfile

@@ -1,7 +1,7 @@
 # Base images pinned by digest for supply-chain reproducibility.
 # Bump deliberately — the human-readable tag in the comment after `#`
 # is for review context, only the @sha256 selects the image.
-FROM golang:1.26-alpine@sha256:f85330846cde1e57ca9ec309382da3b8e6ae3ab943d2739500e08c86393a21b1 AS builder
+FROM golang:1.26-alpine@sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d AS builder
 
 ARG VERSION="v0.0.0"
 ARG COMMIT_HASH="00000000-dirty"

go.mod

@@ -1,6 +1,6 @@
 module github.com/babs/mcp-auth-proxy
 
-go 1.26.2
+go 1.26.3
 
 require (
 	github.com/alicebob/miniredis/v2 v2.37.0