build(deps): bump Go directive to 1.25.11 for stdlib security fixes (#2642)

CI build/test/release jobs install Go via go-version-file: go.mod, so the
go directive controls the stdlib version compiled into the release binary.
Bumping 1.25.10 -> 1.25.11 resolves the stdlib CVEs flagged by grype that
neither the dependabot module bumps nor go module updates can address:

- CVE-2026-42504 (GO-2026-5036), GO-2026-5038 (High)
- CVE-2026-27145 (GO-2026-5037), CVE-2026-42507 (GO-2026-5039) (Medium)

Dockerfile (golang:1.25) and benchmark.yml (go-version: 1.25) already
track the latest 1.25 patch, so no change is needed there.

Signed-off-by: Juan Bustamante <bustamantejj@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jjbustamante

go.mod

@@ -155,4 +155,4 @@ require (
 
 replace github.com/BurntSushi/toml => github.com/BurntSushi/toml v1.3.2
 
-go 1.25.10
+go 1.25.11