ci: ignore golang.org/x/mod sumdb CVEs for the Go tool binaries

[nozaq]

Trivy started reporting CVE-2026-56864 and CVE-2026-56865 (golang.org/x/mod, HIGH), failing the check-image jobs on #338 and #339:

Binary	image	golang.org/x/mod
usr/local/bin/gopls	golang (all variants)	v0.37.0
usr/local/bin/terraform	terraform (all variants)	v0.35.0
usr/local/bin/terraform-ls	terraform (all variants)	v0.38.0
usr/local/bin/tofu	opentofu (all variants)	v0.35.0

usr/local/bin/terraform is not among the failures on #338 — that PR bumps Terraform to 1.15.9, which already ships the fixed v0.40.0 — but it does fail at the 1.15.8 currently on main, so it is covered here too and clears on the next Terraform bump.

Why these are acceptable to ignore

Both advisories are scoped to the checksum database client, and neither symbol is linked into any of the four binaries:

• GO-2026-6180 / CVE-2026-56864 — golang.org/x/mod/sumdb, symbol Client.Lookup
• GO-2026-6179 / CVE-2026-56865 — golang.org/x/mod/sumdb/tlog, symbol tileHashReader.ReadHashes

Inspecting the shipped binaries, the golang.org/x/mod packages actually linked are:

• gopls — modfile, module, semver, internal/lazyregexp
• terraform, tofu — sumdb/dirhash only (directory and zip hashing, a separate package from sumdb)
• terraform-ls — no x/mod package; the module appears only in the Go build info

Trivy matches on the module version recorded in the Go build info rather than the packages linked, so it reports the whole module. Reaching either symbol additionally requires the process to verify modules against an attacker-controlled GOSUMDB/GOPROXY, which none of these binaries does.

The fix is in golang.org/x/mod v0.40.0. Apart from Terraform, no upstream release carries it yet — the gopls and OpenTofu development branches are on v0.39.0 and the Terraform Language Server one on v0.38.0 — so the entries carry the same expired_at: 2026-10-31 as the neighbouring ones and will resurface if upstream has not moved by then.

The Go toolchain itself is unaffected here: cmd/go is fixed in Go 1.25.13 / 1.26.6, and #339 bumps the golang image to 1.25.14 / 1.26.7.

Verification

Ran Trivy v0.73.0 (the version both PRs bump to) against the actual gopls v0.23.0, terraform 1.15.8, terraform-ls 0.39.0 and tofu 1.12.6 binaries laid out at their image paths:

• without the ignore file: exit 1, both CVEs reported on all four binaries
• with this change: exit 0, no findings remaining