security: bump Go toolchain to 1.25.13

[makowda]

Summary

• bump the Microsoft Go FIPS builder and go directive from 1.25.12 to 1.25.13
• update golang.org/x/crypto to 0.55.0 and its coherent x/net/x/text dependency set
• regenerate vendored dependencies

This addresses the current Go stdlib CVEs affecting the published webhook-tls-manager image and GO-2026-5932 in x/crypto.

Verification

• make test-fips: passed; build metadata asserts microsoft_systemcrypto=1
• all unit tests passed
• linux/amd64 Docker image built successfully
• shipped binary reports Go 1.25.13, CGO enabled, and GOEXPERIMENT=systemcrypto
• Trivy v0.72.0-5 isolated-binary scan: zero fixable findings
• git diff --check: passed

After merge, create a release tag and run the Building and Pushing to MCR workflow. The resulting MCR image must be scanned before updating the aks-rp VPA pin.

[makowda]

Shipped-binary Trivy evidence

Validated the final linux/amd64 runtime image built from this PR, not only the source tree or builder stage.

$ go version -m /webhook-tls-manager
/webhook-tls-manager: go1.25.13
  dep golang.org/x/crypto v0.55.0
  dep golang.org/x/net v0.57.0
  dep golang.org/x/text v0.41.0
  build microsoft_systemcrypto=1
  build CGO_ENABLED=1
  build GOEXPERIMENT=systemcrypto

The runtime binary was extracted from webhook-tls-manager:cve-202608 and scanned in isolation so Trivy could not skip it as package-owned content:

$ trivy v0.72.0-5 rootfs --scanners vuln --format json /scan
fixable vulnerabilities: 0

Explicitly absent: CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862, and GO-2026-5932.

Additional validation: make test-fips passed, including the microsoft_systemcrypto=1 assertion and the complete unit-test suite. After merge, the published MCR tag still needs an independent Trivy scan before updating aks-rp.

[Copilot]

Pull request overview

This pull request updates the project’s Go/FIPS build inputs and vendored dependencies to incorporate upstream security fixes, ensuring the published webhook-tls-manager image is rebuilt with the patched Go toolchain and updated golang.org/x/* modules.

Changes:

• Bump Microsoft Go FIPS builder image and go.mod go directive to Go 1.25.13.
• Update golang.org/x/crypto to v0.55.0 (and aligned x/net v0.57.0, x/text v0.41.0) and regenerate vendored dependencies.
• Incorporate vendored upstream fixes (e.g., IDNA/punycode handling and HTTP/2 transport wrapping updates).

Reviewed changes

Copilot reviewed 2 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
Dockerfile	Updates the pinned Microsoft Go FIPS builder image tag to 1.25.13.
go.mod	Bumps the go directive and updates indirect golang.org/x/* module versions.
go.sum	Refreshes module checksums to match updated dependency versions.
vendor/modules.txt	Updates the vendored module inventory to reflect the new x/* versions.
vendor/golang.org/x/net/idna/idna.go	Pulls in upstream security-related IDNA/punycode validation behavior changes.
vendor/golang.org/x/net/http2/transport_wrap.go	Pulls in upstream HTTP/2 transport wrapper changes (Go 1.27+ build-tagged path).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 6 changed files in this pull request and generated no new comments.

[makowda]

Vendored HTTP/2 change provenance

The change in vendor/golang.org/x/net/http2/transport_wrap.go is generated upstream dependency content, not a hand-authored webhook behavior change.

golang.org/x/crypto v0.55.0, selected to remediate GO-2026-5932, explicitly requires golang.org/x/net v0.57.0. Regenerating vendor therefore copied the x/net update from upstream commit bd5f1dcf71cf, titled http2: initialize Transport on NewClientConn.

That upstream fix adds the missing transport initialization on the NewClientConn path (golang/go#80198) and refactors init() to return the initialized *http.Transport, making future missed initialization harder. This repository likely does not directly exercise that path, but retaining the generated file keeps vendor/ exactly consistent with x/net v0.57.0; removing it manually would create vendor drift.

The complete vendored build is covered by the existing FIPS/unit validation, and the shipped binary scan remains zero fixable findings.