upgrade go to 1.25.5 to fix GO-2025-4155 (#2846)

fixs go vuln found 2nd Dec 2025 https://pkg.go.dev/vuln/GO-2025-4155 Signed-off-by: Chris Burns <29541485+ChrisJBurns@users.noreply.github.com> Co-authored-by: Juan Antonio Osorio <ozz@stacklok.com>

Author: ChrisJBurns

go.mod

@@ -1,8 +1,9 @@
 module github.com/stacklok/toolhive
 
-go 1.25.3
+go 1.25.5
 
 require (
+dario.cat/mergo v1.0.2
 github.com/1password/onepassword-sdk-go v0.3.1
 github.com/cedar-policy/cedar-go v1.3.1
 github.com/cenkalti/backoff/v5 v5.0.3
@@ -74,7 +75,6 @@ require (
 cloud.google.com/go/monitoring v1.24.2 // indirect
 cloud.google.com/go/spanner v1.84.1 // indirect
 cloud.google.com/go/storage v1.56.2 // indirect
-dario.cat/mergo v1.0.2 // indirect
 github.com/GoogleCloudPlatform/grpc-gcp-go/grpcgcp v1.5.3 // indirect
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect