Track and improve Go toolchain installation security (remove unverified go.dev download)

## Summary

Currently, `Dockerfile.ubi10` downloads the Go toolchain directly from `go.dev` via `curl` without verifying a checksum or signature. This introduces a supply-chain risk (e.g., compromised download or MITM attack).

## Context

Raised in PR #31 (https://github.com/konveyor/builder/pull/31) by @kaovilai and flagged in review comment https://github.com/konveyor/builder/pull/31#discussion_r2990515531.

## Goal

Remove or replace the unverified `go.dev` download with a secure alternative, such as:
- Fetching the `sha256` checksum from the go.dev API and verifying before extraction.
- Using the official signed Go release artifacts.
- Pinning to a specific verified Go version.

## References

- [go.dev download API](https://go.dev/dl/?mode=json)
- Suggested fix from PR #31 review: fetch sha256 from the API and verify with `sha256sum` before `tar` extraction.

Requested by @kaovilai.