ci: bump Go image to 1.26-alpine for signing-service dep

signing-service depends on github.com/open-policy-agent/opa v1.21.4,
which requires Go >= 1.26.0. The CI Go image and the signing-service
Dockerfile were still pinned to golang:1.23-alpine3.21, so the
"Go (vet + test)" job and the signing-service image build both
failed on main as soon as [DEV-609](/DEV/issues/DEV-609) landed:

    go: module ../signing-service requires go >= 1.26.0
         (running go 1.23.12; GOTOOLCHAIN=local)

Fix: pin both to golang:1.26-alpine3.23 (oldest alpine tag that
exists for the 1.26 line). All other modules declare go 1.23 which
1.26 still accepts, so no downstream churn.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.forgejo/workflows/validate.yml

@@ -119,7 +119,9 @@ jobs:
     runs-on: ubuntu-latest
     container:
       # Alpine image: git 2.45+, speaks sha256 wire protocol; small footprint.
-      image: golang:1.23-alpine3.21
+      # Pinned to 1.26 because signing-service depends on
+      # github.com/open-policy-agent/opa v1.21.4 which requires Go >= 1.26.0.
+      image: golang:1.26-alpine3.23
     steps:
       - name: Install git + bash in container
         run: |

services/signing-service/Dockerfile

@@ -1,7 +1,9 @@
 # syntax=docker/dockerfile:1.7
 
 # ---------- build ----------
-FROM golang:1.23-alpine3.21 AS build
+# Pinned to 1.26 because this module depends on
+# github.com/open-policy-agent/opa v1.21.4 which requires Go >= 1.26.0.
+FROM golang:1.26-alpine3.23 AS build
 
 ENV CGO_ENABLED=0 \
     GOOS=linux \