Update Go toolchain, deps, and vendored web assets

[itsouvalas]

Summary

A version-bump pass across SHIELD's Go toolchain, Go module dependencies, vendored
front-end libraries, and Dockerfile bases. Eleven atomic commits, each scoped to a
single concept (Go toolchain | Dockerfile | dep bump | vendored asset).

The only runtime-code change in the entire series is the lib/github/github.go
rewrite for google/go-github v0 (2015 pseudo-version) → v76. Everything else is
version pins, vendored assets, or go.mod/vendor/ updates. The wrapper's
exported surface (NewClient, Lookup) is unchanged, so callers don't move.

Commits (11)

Subject	Notes
Update Go toolchain to 1.25	Drops toolchain directive (matches typical Go 1.22+ convention). Bundles 15 printf-vet fixes that Go 1.25's stricter default vet surfaces in db/import.go, core/api_v2.go, plugin/docker-postgres/errors.go.
Update Dockerfile to golang 1.25-bookworm	Was four minors behind go.mod.
Update webdav/demo images to nginx bookworm	Bullseye EOL 2026-06; pin nginx minor (1.27) but float patches.
Update mysql driver to v1.9.3	Was v1.5.0 (2020). Driver is registered via blank import only; no API change in our caller. v1.9 carries a filippo.io/edwards25519 indirect for optional MariaDB ed25519 auth (not enabled by SHIELD).
Update go-sqlite3 to v1.14.42	Was v1.14.15. Routine refresh; CGo build surface unchanged.
Update consul api to v1.29.6	Was v1.18.0 (2023). Used only by plugin/consul/plugin.go via thin surface (api.NewClient, api.KVPair, api.KV()); no caller change.
Upgrade google go-github to v76	Was a 2015 pseudo-version with a documented latent bug acknowledged in the in-line comment about v3-vs-v47 ListUserTeams drift. The migrated Teams.ListUserTeams(ctx, opts) call (was Organizations.ListUserTeams(nil)) now actually works. ~10-line code change in lib/github/github.go.
Update routine deps and x/* security baseline	golang.org/x/crypto 0.36 → 0.50, x/net 0.38 → 0.53, x/oauth2 0.30 → 0.36, fsouza/go-dockerclient 1.12.1 → 1.12.4, prometheus/client_golang 1.19 → 1.23. Transitive churn: docker/docker 27 → 28, klauspost/compress 1.16 → 1.18, protobuf 1.33 → 1.36.
Update jQuery to 3.7.1 (XSS CVEs)	Was 3.2.1 (2017), predates CVE-2020-11022 / CVE-2020-11023 fixes in 3.5. Drop-in; SHA cross-checked vs jQuery's published SRI.
Update showdown markdown lib to 2.1.0	Was 1.9.0 (2018). All seven options used in web/htdocs/js/lib.js survive 1.x → 2.x; SHA cross-checked between cdn.jsdelivr.net and unpkg.
Update Font Awesome to 6.7.2 free	Was 5.3.1. Only fab fa-apple and fab fa-linux used at runtime; both unchanged in FA6. SHA cross-checked between use.fontawesome.com and the GitHub release.

Notable decisions

• Go toolchain: go 1.25.5, toolchain directive dropped. With go 1.25.5 as the floor, any installed toolchain ≥ 1.25.5 is auto-selected, so the explicit toolchain line is redundant.
• Held intentionally: github.com/onsi/ginkgo at v1.16.5 and github.com/onsi/gomega at v1.24.2. Ginkgo v1.16.5 is already the final v1 release; the v2 migration is its own breaking-change effort and out of scope for a version-bump PR.
• fsouza/go-dockerclient stays on the v1.12 line (v1.12.4) deliberately. v1.13 is available but adds API-surface changes worth a dedicated cycle.

Smoke testing

Full smoke pass executed against this branch at HEAD 93c1badc. All gating checks GREEN:

Layer	Test	Verdict
Build	make build	clean — 6 binaries + 20 plugins (~28 s)
Unit	make go-tests	agent, db, plugin, timespec all ok
Vet	go vet -mod=vendor ./...	only the 3 inherited benign warnings on develop (db/tenant_test.go self-assignment, plugin/fs/plugin.go:352 unreachable) — no new ones
Plugin CLI	make plugin-tests	134 tests pass
API	make api-tests	398 tests pass (~26 s)
Image	docker build -t shield:smoke .	clean (~1 m 49 s); one cosmetic FromAsCasing warning, pre-existing
OAuth	live GitHub OAuth flow against real github.com	rewritten Lookup() chain executed: Users.Get, Organizations.List, migrated Teams.ListUserTeams
UI assets	byte-exact SHA verify + showdown 2.1.0 render parity check + headless Chrome screenshot for FA glyphs	all clean
Sidecars	webdav + demo nginx-bookworm sidecars	both serve 200 OK (advisory)

The OAuth row is the only test exercising the rewritten lib/github/github.go. Shieldd log line confirming the full chain executed:

auth provider gh (github):
  processing 0 role assignments for Ioannis Tsouvalas (itsouvalas@gh)

Dependabot status

This branch closes 3 of the 6 open alerts on develop (#89 docker firewalld LOW, #90/#91 x/crypto MED ssh memory + agent panic).

The remaining 3 alerts are not exploitable in SHIELD's posture and are intentionally left for routine future bumps rather than expanding this PR's scope:

• show task output should show names instead of UUIDs #92 grpc CRITICAL (google.golang.org/grpc < 1.79.3, server-side authorization-bypass via missing leading slash in :path). SHIELD uses grpc only as a client, transitively via go.etcd.io/etcd/client/v3 to talk to etcd. SHIELD does not run grpc servers.
• shield create store silently fails  #93/shield tasks that cannot start, never leave running #94 docker AuthZ HIGH/MED (docker/docker < 29.3.1, AuthZ plugin bypass / off-by-one). Trigger only when an AuthZ plugin sits in front of the Docker daemon. SHIELD's plugin/docker-postgres/ runs no AuthZ plugin layer.

Acknowledged gap — lib/github/ test coverage

lib/github/ has zero unit-test coverage; the only validation of the v76 rewrite is the live OAuth flow above. Worth a follow-up to add mock-HTTP-based unit tests for Users.Get, Organizations.List, and Teams.ListUserTeams so future bumps don't require operator-driven OAuth dances.

Test plan

Reviewers wanting to reproduce locally:

1. make clean && make build && make test
2. docker build -t shield:smoke .
3. (For the OAuth row) bring up shieldd locally per init/core, register a throwaway OAuth app on github.com with callback http://localhost:9009/auth/gh/redir, configure the github auth provider, walk the consent screen.