Docker image: inaccurate version number for apm-server binary triggers false positive in Trivy vulnerability scans

**APM Server version** (`apm-server version`):

I tested with `docker.elastic.co/apm/apm-server:8.19.16`, but other versions are probably affected.

**Description of the problem including expected versus actual behavior**:

The version number of the apm-server binary (as reported by `go version -m`) in the published docker image (https://www.docker.elastic.co/r/apm) does not match the (presumably actual) version number indicated by the image tag. This causes a false positive when scanning the image for vulnerabilities with Trivy (https://trivy.dev/) because the version of the binary appears to be lower than it actually is.

Expected behavior: CVE-2024-23448 is not reported by Trivy when scanning docker images for apm-server versions 8.12.1 or greater.

Actual behavior: CVE-2024-23448 is reported by Trivy when scanning the docker image for apm-server 8.19.16; Trivy claims that the installed version of apm-server is v0.0.0-20260521171927-f268b5f0c8a3.

**Steps to reproduce**:

To see the output from the Trivy vulnerability scanner, run:

```sh
docker run aquasec/trivy image docker.elastic.co/apm/apm-server:8.19.16 --scanners vuln --severity HIGH,CRITICAL
```

Output (truncated for brevity):

```
[...]

usr/share/apm-server/apm-server (gobinary)
==========================================
Total: 1 (HIGH: 1, CRITICAL: 0)

┌───────────────────────────────┬────────────────┬──────────┬────────┬────────────────────────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├───────────────────────────────┼────────────────┼──────────┼────────┼────────────────────────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ github.com/elastic/apm-server │ CVE-2024-23448 │ HIGH │ fixed │ v0.0.0-20260519231842-3bcd43abdb69 │ 8.12.1 │ APM Server vulnerable to Insertion of Sensitive Information │
│ │ │ │ │ │ │ into Log File │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-23448 │
└───────────────────────────────┴────────────────┴──────────┴────────┴────────────────────────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘
```

To see the version number of the binary as reported by `go version -m`, I extracted the binary from the container and used a locally installed copy of go:

```sh
docker create --name apm-server-container docker.elastic.co/apm/apm-server:8.19.16
docker cp apm-server-container:/usr/share/apm-server/apm-server
go version -m ./apm-server
```

Output (truncated for brevity):

```
./apm-server: go1.26.3
path github.com/elastic/apm-server/x-pack/apm-server
mod github.com/elastic/apm-server v0.0.0-20260519231842-3bcd43abdb69
dep github.com/KimMachineGun/automemlimit v0.7.5 h1:RkbaC0MwhjL1ZuBKunGDjE/ggwAX43DwZrJqVwyveTk=
[...]
dep gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
build -buildmode=exe
build -compiler=gc
build -pgo=default.pgo
build -tags=grpcnotrace
build -trimpath=true
build CGO_ENABLED=0
build GOAMD64=v1
build GOARCH=amd64
build GOOS=linux
build vcs=git
build vcs.modified=false
build vcs.revision=3bcd43abdb695e87064bbf58e5167d959a735bbf
build vcs.time=2026-05-19T23:18:42Z
```

**Provide logs (if relevant)**:

No relevant logs.

**References and related issues/discussions**:

- This may be the same as or similar to https://github.com/elastic/apm-server/issues/19144
- This may be the same as or similar to the problem described in this discussion forum post: https://discuss.elastic.co/t/elastic-apm-security-scan/377634
- Information about how Trivy detects version information for Go artifacts is available here: https://trivy.dev/docs/latest/guide/coverage/language/golang