Fix govulncheck failures (9 CVEs in Go dependencies)

What would you like to be added:
Fix the govulncheck CI failures detected in PR #6435 by addressing known vulnerabilities across affected modules:

• GO-2025-4007, GO-2025-4008, GO-2025-4009, GO-2025-4010, GO-2025-4011
• GO-2025-4012, GO-2025-4013, GO-2025-4155, GO-2026-4603

Affected modules include:

• . (root module)
• ./tool/actions-plan-preview
• ./tool/actions-gh-release
• ./pkg/app/pipedv1/plugin/*

Reference workflow run:

• https://github.com/pipe-cd/pipecd/actions/runs/23225026408

Main failing jobs:

• https://github.com/pipe-cd/pipecd/actions/runs/23225026408/job/67505807200
• https://github.com/pipe-cd/pipecd/actions/runs/23225026408/job/67505807194
• https://github.com/pipe-cd/pipecd/actions/runs/23225026408/job/67505807219

Why is this needed:

• The new govulncheck CI gate is correctly identifying vulnerabilities that currently block PR merges.
• Several findings impact reachable code paths and should be remediated before enabling/merging the checks.
• Resolving these vulnerabilities keeps PipeCD’s CI security posture consistent with the dependency-scanning effort tracked in #6409.

cc: @Warashi @khanhtc1202