fix(security): use Go 1.24.9 for building container binary

Fix CVE-2025-58187 by explicitly using go_1_24 for building the
gitlab-runner-kubevirt binary instead of the default pkgs.go.

Root cause analysis:
- devShell correctly used go_1_24 (version 1.24.9) for development
- However, buildGoModule used default pkgs.go (version 1.25.2 - VULNERABLE)
- The container included the binary built with Go 1.25.2
- Trivy scanned the embedded Go stdlib in the binary and reported CVE

Fix:
- Override buildGoModule to explicitly use pkgs.go_1_24
- Binary now embeds Go 1.24.9 stdlib (verified with go version -m)
- Container scan will now detect patched version

Verification:
$ go version -m ./result/bin/gitlab-runner-kubevirt
./result/bin/gitlab-runner-kubevirt: go1.24.9

CVE Details:
- Package: stdlib
- Severity: HIGH
- Fixed Versions: 1.24.9, 1.25.3
- Link: CVE-2025-58187

Author: thpham

flake.nix

@@ -78,7 +78,7 @@
         packages = {
           default = self.packages.${system}.gitlab-runner-kubevirt;
 
-          gitlab-runner-kubevirt = pkgs.buildGoModule {
+          gitlab-runner-kubevirt = pkgs.buildGoModule.override { go = pkgs.go_1_24; } {
             pname = "gitlab-runner-kubevirt";
             inherit version;