[SamsonNegedu]

Summary

Fixes the failing govulncheck step and stops Dependabot from using up the free CI minutes.

 go.mod
-go 1.26.6
+go 1.26.10                  # stdlib fixes: net/http, net/textproto, crypto/tls, crypto/x509
-golang.org/x/net v0.56.0
+golang.org/x/net v0.60.0

 .github/dependabot.yml
-schedule: weekly
+schedule: monthly
+open-pull-requests-limit: 2
+rebase-strategy: disabled   # a rebase re-runs the full CI, Docker builds included
+go-major / web-major groups

Evidence

• Before: Reachable vulnerabilities: GO-2026-6603, 6605, 6607, 6608, 6610, 6611, 6612, 6613, 6617, 6809 (CI run on main).
  After: CI's own govulncheck filter run locally on Go 1.26.10 prints no reachable findings. GO-2025-3553 stays accepted, as before.
• go build ./... and go test ./... pass.
• Not run: the Dependabot change only takes effect once merged.

Merge Danger

Door: two-way

Blast Radius: Narrow

• Builds now need Go 1.26.10. The Dockerfiles use golang:1.26-alpine, which tracks the latest 1.26.x.
• Dependabot opens fewer, later PRs. The 10 PRs it already has open aren't touched, so close or merge them separately.