ROB-266 Fix Vanta CVEs: Go 1.26.4 + slack-go v0.23.1

[moshemorad]

Summary

Remediates all open vulnerabilities Vanta flagged against the kubewatch container image. Two changes clear the entire list:

1. Pin the build to Go 1.26.4 — the Dockerfile builder is pinned to golang:1.26.4 and go.mod toolchain is set to go1.26.4 (the previous toolchain go1.24.3 line would have forced the old, vulnerable compiler even on a newer base image). Recompiling with the patched stdlib fixes 14 Go stdlib CVEs:
   • HIGH (7.5): CVE-2026-33811, CVE-2026-33814, CVE-2026-39820, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-42504
   • MEDIUM: CVE-2026-27145, CVE-2026-39817, CVE-2026-39819, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-42507
2. Upgrade github.com/slack-go/slack from v0.6.5 to v0.23.1 — fixes GHSA-gxhx-2686-5h9g. The APIs in use (slack.New, PostMessage, MsgOption helpers, WebhookMessage, PostWebhook) are unchanged, so this is drop-in.

This branch was merged with master, which separately bumped the builder to golang:1.26.2 (PR 111). The merge keeps Go 1.26.4 since it supersedes 1.26.2 and is the floor required by the HIGH CVEs above, and preserves master glibc and stdlib CVE comments.

Tests performed

• go build ./... and go vet ./... pass after the dependency and toolchain bump.
• Unit tests in pkg/handlers/slack pass with slack-go v0.23.1. Note: TestWebhookInit in pkg/handlers/slackwebhook fails identically on master (a pre-existing validation/test mismatch), so it is unrelated to this change.
• Built a multi-arch image (linux/amd64 and linux/arm64) and deployed it to a live AKS cluster as the robusta-forwarder (kubewatch) pod.
• Verified the deployed binary build info reports go1.26.4 and slack-go v0.23.1.
• Verified the pod is Running with 0 restarts and actively forwards events (log line: Message successfully sent to the robusta-runner handle endpoint).

Generated with Claude Code.