fix: remediate CVEs in release images

[shanshanying]

What this PR does

• update the Go toolchain and image build stages to Go 1.25.13
• upgrade vulnerable Go dependencies used by KubeBlocks and kb-tools images
• refresh root module checksums

Verification

• go mod verify
• go mod tidy -diff
• govulncheck on built entry points
• make test-fast
• build verification with Go 1.25.13

The api-doc module remediation is intentionally excluded and will be reviewed separately.

Refs #10796

[apecloud-bot]

Auto Cherry-pick Instructions

Usage:
  - /nopick: Not auto cherry-pick when PR merged.
  - /pick: release-x.x [release-x.x]: Auto cherry-pick to the specified branch when PR merged.

Example:
  - /nopick
  - /pick release-1.1

CLA Recheck Instructions

Usage:
  - /recheck-cla: Trigger a re-check of CLA status for this pull request.
Example:
  - /recheck-cla

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.79%. Comparing base (d7c3a5a) to head (cf6af7e).
⚠️ Report is 5 commits behind head on release-1.1.

Additional details and impacted files

@@               Coverage Diff               @@
##           release-1.1   #10802      +/-   ##
===============================================
+ Coverage        54.35%   55.79%   +1.44%     
===============================================
  Files              546      550       +4     
  Lines            61511    62584    +1073     
===============================================
+ Hits             33432    34919    +1487     
+ Misses           24868    24344     -524     
- Partials          3211     3321     +110     

Flag	Coverage Δ
unittests	55.79% <ø> (+1.44%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.