fix(deps): bump Go toolchain to 1.26.6 for stdlib CVE fixes

[rcmi26133]

What this PR does / why we need it:

The released fluent-operator and fluent-bit images are built from this module's single root go.mod toolchain, currently pinned to go 1.26.3, which ships two known, already-patched Go stdlib CVEs:

CVE	Component	Fixed in
CVE-2026-39821	Go stdlib (net/http/idna ToASCII/ToUnicode confusion)	Go 1.25.13 / 1.26.6 / 1.27.0-rc.3
CVE-2026-46600	Go stdlib (DNS SVCB/HTTPS RR parsing panic)	Go 1.26.6 / 1.27.0-rc.3

Both cmd/manager (the operator) and cmd/fluent-watcher/fluentbit (fluent-bit-watcher) are built from this root go.mod, so both released binaries carry both findings.

This PR bumps the go directive from 1.26.3 to 1.26.6, which resolves both stdlib CVEs.

Note: issue #2044 also flagged CVE-2026-56852 in golang.org/x/text (fixed in v0.39.0). golang.org/x/text is already at v0.41.0 on master, so that finding is already resolved and no dependency change is needed here.

go build ./... passes cleanly with the Go 1.26.6 toolchain.

Which issue(s) this PR fixes:

Fixes #2044

Does this PR introduced a user-facing change?

Bump Go toolchain to 1.26.6 to resolve CVE-2026-39821 and CVE-2026-46600 in the published operator and fluent-bit images.

Additional documentation, usage docs, etc.:

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The change is narrowly scoped to a Go toolchain patch-level bump in go.mod and aligns with the stated security remediation goal.

Pull request overview

This PR updates the repository’s root Go module toolchain requirement so released operator and watcher binaries are built with a patched Go stdlib version addressing the CVEs called out in issue #2044.

Changes:

• Bump the go directive in go.mod from 1.26.3 to 1.26.6 to pick up stdlib security fixes (CVE-2026-39821, CVE-2026-46600).

File summaries

File	Description
go.mod	Raises the minimum Go toolchain version used to build the project to a patched release.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The fluent-bit watcher image build workflow appears to still build with a Dockerfile default GO_VERSION=1.26.3 (no GO_VERSION override from go.mod), so the PR may not actually remediate the stated CVEs in published fluent-bit images.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

[marcofranssen]

LGTM 🚀