Raise Go to the latest release, update dependencies, use the standard library uuid, add a vulnerability check (closes #102)

Go 1.27.1 in go.mod and in the Dockerfile's test and build images.
Every module go.mod requires is at its current release; protoc-gen-go
follows protobuf to v1.36.12 and mf.pb.go is regenerated. The standard
library uuid package replaces github.com/google/uuid; FromBytes could
only fail on a length validateUUID already checks, so that call and its
unreachable error are gone. make vulncheck runs govulncheck v1.8.0,
installed with go install at its release commit, in a vulncheck stage
of the Dockerfile; script/check does not run it. The newer go directive
switches on lint checks for strings.SplitSeq and t.Chdir, now used. A
new test pins the bytes of a seeded manifest written by an mfer built
before this change.

Model: opus-5-5

internal/cli/fetch_test.go

@@ -19,8 +19,8 @@ import (
 	"sync/atomic"
 	"testing"
 	"time"
+	"uuid"
 
-	"github.com/google/uuid"
 	"github.com/klauspost/compress/zstd"
 	"github.com/multiformats/go-multihash"
 	"github.com/spf13/afero"
@@ -186,12 +186,7 @@ func chdirTemp(t *testing.T) string {
 	t.Helper()
 
 	destDir := t.TempDir()
-
-	origDir, err := os.Getwd()
-	require.NoError(t, err)
-
-	require.NoError(t, os.Chdir(destDir))
-	t.Cleanup(func() { _ = os.Chdir(origDir) })
+	t.Chdir(destDir)
 
 	return destDir
 }
@@ -1456,7 +1451,7 @@ func manifestWithMode(t *testing.T, path string, content []byte, mode uint32) []
 	hash, err := multihash.Encode(digest[:], multihash.SHA2_256)
 	require.NoError(t, err)
 
-	id := uuid.New()
+	id := uuid.NewV4()
 
 	inner, err := proto.Marshal(&mfer.MFFile{
 		Version: mfer.MFFile_VERSION_ONE,