chore: upgrade Go and dependencies; stabilize cross-compilation

[AlliotTech]

Changes

• Upgrade Go to 1.27.1, pin project-local asdf and the official Go Alpine builder image, and update build prerequisites.
• Replace floating Snap/beta Zig installation with official Zig 0.14.1 verified by SHA-256. Windows ARM64 uses the existing build.sh cross-compile function instead of cgo-actions' unconditional Snap install. Release workflows share the same installer; unused Zig setup is removed from xgo release jobs.
• Preserve all existing build targets and artifact groups. Test both default and production jsoniter variants, and execute the native linux-amd64-musl binary's version command in remote CI.
• Apply targeted dependency upgrades below and the transitive versions required by MVS (including AWS SDK, QUIC, and sonic). No blanket go get -u, no unrelated driver backports, and no OIDC/JWT/regexp2/Resty/WebAuthn major migration.

Requested dependency targets

Module	Previous	Updated
github.com/rclone/rclone	v1.74.4	v1.75.1
google.golang.org/grpc	v1.82.1	v1.84.0
golang.org/x/crypto	v0.54.0	v0.57.0
golang.org/x/net	v0.57.0	v0.59.0
golang.org/x/oauth2	v0.36.0	v0.37.0
golang.org/x/image	v0.44.0	v0.46.0
golang.org/x/text	v0.40.0	v0.42.0
golang.org/x/sync	v0.22.0	v0.23.0
github.com/gin-contrib/cors	v1.7.7	v1.7.9
github.com/mattn/go-sqlite3	v1.14.22	v1.14.52
github.com/jackc/pgx/v5	v5.9.2	v5.11.0
github.com/go-sql-driver/mysql	v1.8.1	v1.10.1
gorm.io/driver/postgres	v1.6.0	v1.6.3

Validation

• Application compilation and tests for this update run exclusively in GitHub Actions, per maintainer request.
• Local work was limited to editing, module resolution and source inspection. The 13 requested module versions are present; Go remains 1.27.1.
• Remote CI passed on d81b73357cb28279dc1b8491dd8de29a78b92868: build run 35750526373.
  • Test (default) and Test (jsoniter): passed.
  • Build (xgo), Build (musl), Build (windows-arm64), Build (android-arm64): passed.
  • Windows ARM64 installation verified the official Zig 0.14.1 archive SHA-256 successfully, then built successfully without Snap.
  • The native linux-amd64-musl executable smoke reported go1.27.1 linux/amd64.
• Requested module selections were checked against all 13 targets. Selected rclone/gRPC versions meet the published fixed-version thresholds for the 16 recorded alerts; exploitability is not inferred from dependency alerts.
• Validation covers the PR test/build matrix and native CLI smoke, not live third-party cloud accounts or a tag-triggered release publication.
• The previous Windows ARM64 failure occurred while Snap downloaded Zig (HTTP 502), before Go compilation; the new path removes that dependency.
• rclone/gRPC updates cover the version ranges in the currently open dependency alerts. This does not assert every advisory was reachable in this application. The existing imaging advisory has no published fix and is not changed here.