Bump Go toolchain to 1.26.4 to resolve net/textproto vuln (CVE-2026-42507 / GO-2026-5039)

Summary
go.mod currently declares go 1.26.3, which is affected by CVE-2026-42507 (Go advisory GO-2026-5039) in the standard-library net/textproto package. Binaries built with Go 1.26.0–1.26.3 include the vulnerable code.

Impact
Functions in net/textproto include raw input in returned error messages, allowing log/error-message injection. Integrity-only (CVSS ~4–5, no confidentiality/availability impact), but it surfaces in downstream container security scans.

Code pointer

• Line to change — go.mod:3 declares go 1.26.3: https://github.com/temporalio/ui-server/blob/a823c54e83bd348fd9cc76f553ca1582195edab6/go.mod#L3
• Root cause lives in the Go stdlib net/textproto (e.g. Reader.ReadCodeLine / Reader.ReadMIMEHeader / Error.Error): https://github.com/golang/go/blob/master/src/net/textproto/reader.go

Fix
Build with Go ≥ 1.26.4. Bumping the go directive / CI toolchain and cutting a release would clear the finding for downstream consumers.

References

• Advisory: https://pkg.go.dev/vuln/GO-2026-5039
• Go issue: https://go.dev/issue/79346
• Patch: https://go.dev/cl/777060

Start with go.mod line 3, then inspect the repository’s CI toolchain configuration to find every place the Go version is pinned. Verify the project builds with Go 1.26.4 or newer and that the reported GO-2026-5039 finding is cleared; release handling is also mentioned in the issue.