fix(security): close High/Critical findings from the Stage 8 scan

- Bump github.com/rabbitmq/amqp091-go 1.12.0 -> 1.13.0 (3 Critical, 7 High,
  reachable via rabbitmq.Connect) and golang.org/x/{text,net,crypto},
  klauspost/compress; toolchain go1.26.8, builder image pinned to
  golang:1.26.8-alpine3.24.
- Build Content-Disposition per RFC 6266/8187 (ASCII fallback +
  filename*=UTF-8''), stripping CR/LF, quotes and backslashes (CWE-113).
- Cap request bodies with MaxBytesReader (HTTP_MAX_UPLOAD_BYTES, default
  2 GiB); multipart uploads over the limit return 413 (CWE-400).
- /readyz reports "unavailable" instead of raw backend errors (CWE-209).
- Drop deprecated middleware.RealIP; add X-Content-Type-Options: nosniff.
- docker-compose credentials come from ${VAR:-default}.
- Check the RegisterValidation error; annotate verified gosec false
  positives with #nosec and a reason.

Re-scan: govulncheck 0 reachable, trivy fs/image 0 High/Critical,
gosec High 0. go test -race passes against PostGIS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/package/Dockerfile

@@ -1,5 +1,8 @@
 # Build context is the repo root: docker build -f build/package/Dockerfile .
-FROM golang:1.26-alpine3.24 AS builder
+# Go patch release pinned (not the floating 1.26 tag) so the shipped standard
+# library is reproducible and includes the security fixes up to go1.26.8;
+# keep in step with the `toolchain` line in go.mod.
+FROM golang:1.26.8-alpine3.24 AS builder
 
 # godal (GDAL bindings) needs cgo, a C/C++ toolchain and the GDAL headers.
 # g++ is required: parts of the binding compile as C++ against GDAL's headers.
@@ -14,7 +17,7 @@ COPY . .
 RUN CGO_ENABLED=1 GOOS=linux go build -trimpath -o /out/gis ./cmd/gis
 
 # Must stay on the same Alpine release as the builder — hence the pinned
-# `golang:1.26-alpine3.24` above rather than the floating `-alpine` tag. A
+# `golang:1.26.8-alpine3.24` above rather than the floating `-alpine` tag. A
 # mismatch ships a different libgdal soname, and the image still builds green
 # while the binary dies at startup with "libgdal.so.NN: No such file".
 # Bump both lines together.