govulncheck source scan fails for plugins on Go 1.27 (govulncheck built with Go 1.26)

Plugins with `go 1.27.0` in go.mod fail the govulncheck source scan with
Error severity `govulncheck-scan-failed`, blocking validation:

This application uses version `go 1.26` of the source-processing packages
but runs version `go 1.27` of `go list`
`/usr/local/go/src/math/rand/v2/rand.go:213:17: method must have no type parameters`

Cause: the govulncheck binary is built in the `golang:1.26-alpine` builder
stage, while the Go toolchain used by `go list` at runtime is 1.27. Go 1.27
stdlib uses generic methods, which the 1.26 go/types packages cannot parse.

Same class of mismatch as #617.

Running govulncheck v1.7.0 built with Go 1.27 locally on the same module
reports "No vulnerabilities found".

Suggested fix: build govulncheck with the same Go version that runs at
runtime (or install it with GOTOOLCHAIN=auto at build time), and keep the
builder and runtime stages in sync.

Locate the container build definition and compare the Go version in the govulncheck builder stage with the runtime go toolchain used by go list. Reproduce the source scan against a plugin declaring go 1.27, then verify the scan completes without the version-mismatch error and reports the expected vulnerability result.

Written by the indexing model from the issue text.