Security: GOFLAGS env bypasses toolexec check in gobuild.go

## Summary

The toolexec security check at `pkg/build/gobuild.go:925-931` only inspects the `flags`/`ldflags` args slice. It does not inspect the build environment. The `.ko.yaml` `env` field passes environment variables directly to `go build` via `buildEnv()` at lines 570-571 with no filtering.

Setting `GOFLAGS=-toolexec=/path/to/script` in the `env` field bypasses the check because Go's toolchain reads `GOFLAGS` from the environment.

Additionally, `-overlay` and `-modfile` are not blocked in either path (args or env), enabling source file substitution during build.

## Reproduce

`.ko.yaml`:
```yaml
builds:
- env:
- GOFLAGS=-toolexec=/tmp/test.sh
```

Where `/tmp/test.sh` is `#!/bin/sh\nexec "$@"`. The script executes on every compiler/linker invocation during `ko build`.

## Impact

A PR modifying `.ko.yaml` to add `GOFLAGS=-toolexec=...` in the env field can achieve code execution on CI runners, bypassing the existing toolexec mitigation.

## Suggested fix

Filter `GOFLAGS` from the build environment in `buildEnv()`, or extend the args check to also inspect env entries for `toolexec`, `overlay`, and `modfile`.

cc @imjasonh @jonjohnsonjr -- I could not find a private disclosure channel for this project. Happy to discuss privately if preferred.

Start in pkg/build/gobuild.go at the toolexec check around lines 925-931 and buildEnv() around lines 570-571. Reproduce the GOFLAGS=-toolexec case from the issue, then trace how environment and argument entries reach go build. Done means toolexec, overlay, and modfile are blocked in both paths and the reproduction no longer executes the script.

Written by the indexing model from the issue text.