[go] update toolchain go 1.26.5 -> 1.26.6

https://groups.google.com/g/golang-announce/c/94pEornpRlI

=== Symbol Results ===

Vulnerability #1: GO-2026-6218
    Avoid quadratic complexity in resolvePath in net/url
  More info: https://pkg.go.dev/vuln/GO-2026-6218
  Standard library
    Found in: net/url@go1.26.5
    Fixed in: net/url@go1.26.6
    Example traces found:
      #1: toolsupport/abfsutil/abfs.go:193:26: abfsutil.Client.RegisterFiles calls http.Client.Do, which eventually calls url.URL.Parse

Vulnerability #2: GO-2026-6091
    Fix Javascript regexp context tracking in html/template
  More info: https://pkg.go.dev/vuln/GO-2026-6091
  Standard library
    Found in: html/template@go1.26.5
    Fixed in: html/template@go1.26.6
    Example traces found:
      #1: build/statusz.go:98:15: build.NewStatuszServer calls http.Server.Serve, which eventually calls template.Template.Execute
      #2: build/statusz.go:98:15: build.NewStatuszServer calls http.Server.Serve, which eventually calls template.Template.ExecuteTemplate

Vulnerability #3: GO-2026-6090
    Limit handshake messages we are willing to accept post-handshake in
    crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2026-6090
  Standard library
    Found in: crypto/tls@go1.26.5
    Fixed in: crypto/tls@go1.26.6
    Example traces found:
      #1: reapi/proxy.go:164:24: reapi.Serve calls grpc.Server.Serve, which eventually calls tls.Conn.Handshake
      #2: build/statusz.go:98:15: build.NewStatuszServer calls http.Server.Serve, which eventually calls tls.Conn.HandshakeContext
      #3: hashfs/fs.go:864:22: hashfs.HashFS.ReadFile calls io.ReadFull, which eventually calls tls.Conn.Read
      #4: o11y/trace/trace.go:593:20: trace.Tracer.Close calls bufio.Writer.Flush, which calls tls.Conn.Write
      #5: toolsupport/abfsutil/abfs.go:193:26: abfsutil.Client.RegisterFiles calls http.Client.Do, which eventually calls tls.Dialer.DialContext

Vulnerability #4: GO-2026-6089
    Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
  More info: https://pkg.go.dev/vuln/GO-2026-6089
  Standard library
    Found in: net/http@go1.26.5
    Fixed in: net/http@go1.26.6
    Example traces found:
      #1: webui/serve.go:568:28: webui.WebuiServer.Serve calls http.ListenAndServe
      #2: build/statusz.go:98:15: build.NewStatuszServer calls http.Server.Serve

Vulnerability #5: GO-2026-5972
    Enforce maximum recursion depth in encoding/asn1
  More info: https://pkg.go.dev/vuln/GO-2026-5972
  Standard library
    Found in: encoding/asn1@go1.26.5
    Fixed in: encoding/asn1@go1.26.6
    Example traces found:
      #1: auth/cred/cred.go:404:29: cred.lazyCredWrapper.Token calls oauth2.reuseTokenSource.Token, which eventually calls asn1.Unmarshal

Vulnerability #6: GO-2026-5026
    Invoking failure to reject ASCII-only Punycode-encoded labels in
    golang.org/x/net/idna
  More info: https://pkg.go.dev/vuln/GO-2026-5026
  Standard library
    Found in: net/http@go1.26.5
    Fixed in: net/http@go1.26.6
    Example traces found:
      #1: toolsupport/abfsutil/abfs.go:193:26: abfsutil.Client.RegisterFiles calls http.Client.Do
      #2: auth/cred/cred.go:404:29: cred.lazyCredWrapper.Token calls oauth2.reuseTokenSource.Token, which eventually calls http.Client.PostForm
      #3: webui/watch_handlers.go:45:24: webui.WebuiServer.handleOutdirWatch calls http.Get

Your code is affected by 6 vulnerabilities from the Go standard library.
This scan also found 1 vulnerability in packages you import and 2
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.

Change-Id: I6e4a2aa95382335c6c046780e6441e3eeb6192a3
Reviewed-on: https://chromium-review.googlesource.com/c/build/+/8254719
Reviewed-by: Richard Wang <richardwa@google.com>
Auto-Submit: Fumitoshi Ukai <ukai@google.com>
Commit-Queue: Richard Wang <richardwa@google.com>