deps: bump go to 1.25.10 to fix GO-2026-4971 and GO-2026-4918

[dlevy-msft-sql]

Problem

Govulncheck is failing on PRs (e.g. #751) with two stdlib vulnerabilities present in go 1.25.9:

• GO-2026-4971 -- panic in net.Dial/LookupPort on Windows when handling NUL byte. Fixed in net@go1.25.10.
• GO-2026-4918 -- infinite loop in net/http HTTP/2 transport on bad SETTINGS_MAX_FRAME_SIZE. Fixed in net/http@go1.25.10.

Root Cause

The Go toolchain version (go.mod directive and go-version inputs in workflows) is hardcoded as 1.25.9 and is not maintained by Dependabot:

• The gomod ecosystem does not update the go directive.
• The github-actions ecosystem does not update arbitrary with: string inputs like go-version.

So nobody bumps these. Stdlib CVEs require manually advancing the toolchain.

Solution

Bump the toolchain patch version from 1.25.9 to 1.25.10 in:

• go.mod
• .github/workflows/pr-validation.yml
• .github/workflows/golangci-lint.yml

Staying on the 1.25 minor line to keep the change minimal. The devcontainer Dockerfile only pins the major.minor (1.25), so the version-alignment check still passes without changes there.

Changes

File	Change
go.mod	go 1.25.9 -> go 1.25.10
.github/workflows/pr-validation.yml	go-version: '1.25.9' -> '1.25.10'
.github/workflows/golangci-lint.yml	go-version: '1.25.9' -> '1.25.10'

Testing

• go build ./... passes locally with the auto-downloaded go1.25.10 toolchain.
• Govulncheck on this branch should now report no stdlib calls affected.

Related

• Unblocks deps(deps): bump the golang-x group with 3 updates #751 (Dependabot golang-x bump) and any other PR currently failing the Go Vulnerability Check.