fix: bump Go to 1.25.11 to fix CVE-2026-42504 and CVE-2026-33811

[shibd]

Summary

• Upgrades Go stdlib from 1.25.10 to 1.25.11 across all CI workflows, go.mod, and test Dockerfile
• Fixes CVE-2026-42504 (HIGH): DoS via maliciously-crafted MIME header with many parameters (fixed in 1.25.11)
• Fixes CVE-2026-33811 (HIGH): net package DoS via long host names (fixed in 1.25.10, present in pulsarctl-kube binary still at 1.25.9)

These vulnerabilities were detected by Trivy in sn-platform-slim:4.2.1.1:

• pulsar/bin/pulsarctl compiled with stdlib v1.25.10, vulnerable to CVE-2026-42504
• pulsar/plugins/pulsarctl-kube compiled with stdlib v1.25.9, vulnerable to CVE-2026-33811

Files changed

• go.mod: bumped go directive from 1.25.10 to 1.25.11
• .github/workflows/ci-*.yml: updated go-version from 1.25.10 to 1.25.11
• scripts/test-docker/Dockerfile: updated base image from golang:1.25.10-alpine to golang:1.25.11-alpine

Related Issues

• Fixes streamnative/eng-support-tickets#4626
• Fixes streamnative/eng-support-tickets#4627

Test plan

• CI Trivy scan passes with no HIGH/CRITICAL stdlib CVEs after build
• All existing CI checks pass on branch-4.2

🤖 Generated with Claude Code

[github-actions]

@shibd:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)