Move to Go 1.26.6 and bump the conformance runner dependencies past their advisories
Clears every open security alert on this repo and the red checks on #157.
Go toolchain 1.26.5 → 1.26.6 (go.work, go/go.mod, conformance/runner/go/go.mod). govulncheck ./... under the declared go1.26.5 reports four reachable standard-library vulnerabilities — GO-2026-6218 (net/url), GO-2026-6090 (crypto/tls), GO-2026-5972 (encoding/asn1), GO-2026-5026 (net/http) — all fixed in the 1.26.6 security release; that is what fails the Go Vulnerability Check on #157, and it fails on any fresh run of main. 1.26.6 is the smallest bump that clears it (1.26.7 and 1.26.8 carry no security fixes), and it keeps the minimum below fizzy-cli's declared 1.26.6.
golang.org/x/mod 0.37.0 → 0.41.0 — Trivy #74 (CVE-2026-56864) and #75 (CVE-2026-56865), and the Trivy (Go) red on #157. Indirect via x/tools; not reachable from SDK code. x/sync, x/sys, x/tools moved with it through go mod tidy. conformance/runner/go/go.mod was not tidy against the replaced ../../../go module and is now.
conformance/runner/typescript: vitest ^3.0.0 → ^4.1.11 — Dependabot #27 (GHSA-5xrq-8626-4rwp, critical), #55 and #56 (GHSA-82fw-gwwq-j7x9). The two mocker advisories need 4.1.11, so this is the major bump; the runner is the only consumer and basecamp/sdk's seed already ships vitest 4.
conformance/runner/ruby: json 2.20.0 → 3.0.2 — Dependabot #50 (GHSA-9hj4-r449-hfvc).
Verified locally: the full make check passes (every language check and drift check, Smithy, and the Go, TypeScript, Ruby and Kotlin conformance runners — 127/127 each); govulncheck ./... under go1.26.6 is clean.
Once this merges, #157 needs @dependabot rebase to pick it up.
typescript/: js-yaml 4.3.1 → 4.3.2 (second commit) — GHSA-2883-xcg3-v3hh, dev-only via openapi-typescript → @redocly/openapi-core, published after main's last green scheduled npm Audit on 2026-09-07, so main is red on it too. Lockfile-only; make ts-check and ts-check-drift pass.
The one remaining red, CodeQL's default-setup Analyze (java-kotlin), fails identically on main's last two runs (2026-09-03, 2026-09-05) and is not touched here.