Release binaries embed Go 1.27.0 stdlib with known DoS CVEs (CVE-2026-78667, CVE-2026-78669, CVE-2026-97031) #347

The release binaries are built with the Go toolchain resolved from go.mod (actions/setup-go with go-version-file), so v0.15.1 ships with the Go 1.27.0 stdlib (go version -m dockerize-linux-amd64-v0.15.1.tar.gz -> go1.27.0).

That stdlib is affected by three HIGH DoS issues, all fixed in 1.26.9 / 1.27.2:

• CVE-2026-78667 - net/http: Denial of Service via crafted HTTP Range headers
• CVE-2026-78669 - net/http/internal/http2: Denial of Service via excessive HTTP/2 SETTINGS
• CVE-2026-97031 - crypto/tls: Denial of Service via multiple ECH outer extension references

dockerize only makes outbound connections, so the real-world exposure is low, but it ships inside container images that are vulnerability-scanned (we scan our foreman-proxy images with Trivy, --exit-code 1 on HIGH): the release binaries fail such scans until a release embeds a fixed stdlib.

Ask: bump the go directive in go.mod to 1.27.2 and cut a patch release. I opened PR #348 with the one-line change.

Context: we build foreman-proxy container images (gitlab.com/6admin.io/docker/foreman) that use dockerize for template rendering; the scan gate is why this matters to us.