fix: [CI-21721]: Release/harness vm runner plugin CVE 25679 (#57)

* fix: [CI-21721]: Update Go toolchain to resolve CVE-2026-25679

Updates Go toolchain to address security vulnerability:

- CVE-2026-25679 (HIGH): Incorrect IPv6 host literal parsing in net/url.
  Updated Go toolchain from v1.25.7 to v1.25.8

This vulnerability was published on March 6, 2026 and affects URL parsing
for IPv6 addresses.

Note: CVE-2025-15558 in docker/cli v28.0.4 remains unresolved as upgrading
to v29.2.0 would break compatibility with harness/nektos-act/v2 v2.0.0.
This is a Windows-specific vulnerability with limited impact for Linux-only
builds. Tracking upgrade when nektos-act supports docker/cli v29+.

* fix: [CI-21813]: Bump golang.org/x/net to v0.51.0 to fix GO-2026-4559

Addresses HTTP/2 server panic vulnerability (GO-2026-4559) in
golang.org/x/net. The x/net v0.51.0 release fixes a bug where
sending certain HTTP/2 frames could cause a server to panic.

Author: spahuja-harness

go.mod

@@ -1,6 +1,6 @@
 module github.com/drone/plugin
 
-go 1.24.0
+go 1.25.0
 
 toolchain go1.25.8
 
@@ -112,7 +112,7 @@ require (
 	go.opentelemetry.io/otel/metric v1.35.0 // indirect
 	go.opentelemetry.io/otel/trace v1.35.0 // indirect
 	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/net v0.50.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
 	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/sys v0.41.0 // indirect
 	golang.org/x/term v0.40.0 // indirect

go.sum

@@ -284,8 +284,8 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
-golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=