chore(deps): bump Go and deps for CVE remediation

[infernus01]

Changes

Bump Go from 1.26.1 to 1.26.5 and update 3 indirect
dependencies.
Go stdlib (1.26.1 → 1.26.5):

• CVE-2026-39822 (Important) — os.Root symlink escape
• CVE-2026-42505 (Moderate) — crypto/tls ECH privacy leak
  Dependency bumps:
• github.com/sigstore/sigstore-go 1.1.4 → 1.2.1 (CVE-2026-49834)
• github.com/google/cel-go 0.28.1 → 0.29.2 (GHSA-gcjh-h69q-9w9g)
• github.com/go-chi/chi/v5 5.2.5 → 5.3.0 (GHSA-3fxj-6jh8-hvhx, GHSA-rjr7-jggh-pgcp, GHSA-9g5q-2w5x-hmxf)

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Has Docs included if any changes are user facing
• Has Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including
  functionality, content, code)
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign vdemeester after the PR has been reviewed.
You can assign the PR to them by writing /assign @vdemeester in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[infernus01]

/kind misc