CI: Add govulncheck / Bump main Go version

[bbrks]

• Add govulncheck to CI workflow
• Bump to latest Go version in main
• Bump golangci-lint action and tool due to Go version upgrade
• Tag activeReplicatorCommon async reconnect function with go:norace directive - fails reliably after Go version change in GH Actions

Integration Tests

• GSI=true,xattrs=true https://jenkins.sgwdev.com/job/SyncGatewayIntegration/212/

[Copilot]

Pull request overview

This PR upgrades the Go version to 1.25.5 across the Sync Gateway project and adds vulnerability scanning via govulncheck to the CI workflow. The upgrade affects build configurations, CI pipelines, and linting tools.

Key changes:

• Go version bumped from 1.24.x to 1.25.5 across all configuration files
• Added new govulncheck job to GitHub Actions CI workflow
• Updated golangci-lint action from v7 to v9 and tool version from v2.0.2 to v2.7

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
manifest/product-config.json	Updated Go version in product manifest for main branch
go.mod	Updated Go directive to require version 1.25.5
Jenkinsfile	Updated Go tools version for Jenkins CI pipeline
.github/workflows/ci.yml	Updated Go version across all CI jobs, upgraded golangci-lint action and version, added govulncheck job

[bbrks]

FYI this looks like a legitimate race in ActiveReplicator arc.ctx that may be more reliably detectable now? I'll check it out a little more tomorrow.

[torcolvin]

LGTM

github now provide yaml anchors if we wanted to deduplicate the constants in the future https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#yaml-anchors-and-aliases