chore(deps): bump go to 1.27.2 and x/net, x/text for security fixes

[chiliec]

Summary

Addresses the security findings in #1147 by bumping the Go toolchain directive and the flagged golang.org/x modules.

• go directive: 1.27.1 → 1.27.2 (stdlib security fixes released 2026-10-08)
• golang.org/x/net: v0.57.0 → v0.60.0
• golang.org/x/text: v0.40.0 → v0.42.0

x/net v0.60.0 requires x/text >= v0.42.0, so this goes one minor past the scanner's suggested v0.41.0. go mod tidy also pulled the required transitive bumps of x/crypto, x/mod, x/sync, and x/sys. All of these are indirect dependencies — no source changes needed.

Validation

Built and tested locally with Go 1.27.2 on Linux/amd64 (the same -short suite CI runs):

go build ./...        # clean
go test -short ./...  # all packages ok, no failures
go mod verify         # all modules verified

Full go test -short ./... passed with TEST_EXIT=0.

Fixes #1147

[alexluong]

Thanks!