Build and scan with the Go 1.27.3 toolchain

Build and scan with the Go 1.27.3 toolchain

govulncheck on Go 1.27.1 reports 13 reachable standard-library
vulnerabilities (net/http, HTTP/2, crypto/tls, crypto/x509,
html/template, net/textproto). Most fix in 1.27.2; GO-2026-6809 in
crypto/x509 fixes in 1.27.3.

Pin the toolchain in go.mod, run verify and release in an image that
carries it, and make reachable vulnerabilities fail both. The base image
is pinned by digest so the compiler that passes a push is the compiler
the tag is built with, and the scanner is pinned like nfpm already is.

The release build also sets SOURCE_DATE_EPOCH from the tag and drops the
build id, so the same tag rebuilds byte for byte.

Dependencies are refreshed to their current releases: x/net 0.61.0,
libc 1.79.1, msgp 1.6.5, regexp2 2.11.0, cbor 2.9.6, fwd 1.2.1. x/crypto
is already at its latest v0.58.0; the remaining GO-2026-5932 module
finding is the unused openpgp package, which the scan does not count as
reachable.