Raise Go to the latest release, update dependencies, use the standard library uuid, add a vulnerability check (closes #102)

Go 1.27.1 in go.mod and in the Dockerfile's test and build images.
Every module go.mod requires is at its current release; protoc-gen-go
follows protobuf to v1.36.12 and mf.pb.go is regenerated. The standard
library uuid package replaces github.com/google/uuid; FromBytes could
only fail on a length validateUUID already checks, so that call and its
unreachable error are gone. make vulncheck runs govulncheck v1.8.0,
installed with go install at its release commit, in a vulncheck stage
of the Dockerfile; script/check does not run it. The newer go directive
switches on lint checks for strings.SplitSeq and t.Chdir, now used. A
new test pins the bytes of a seeded manifest written by an mfer built
before this change.

Model: opus-5-5

mfer/deserialize.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/google/uuid"
 	"github.com/klauspost/compress/zstd"
 	"github.com/spf13/afero"
 	"google.golang.org/protobuf/encoding/protowire"
@@ -19,7 +18,6 @@ import (
 
 var (
 	errInvalidUUIDLength    = errors.New("invalid UUID length")
-	errInvalidUUIDFormat    = errors.New("invalid UUID format")
 	errUnknownVersion       = errors.New("unknown version")
 	errUnknownCompression   = errors.New("unknown compression type")
 	errCompressedHashWrong  = errors.New("compressed data hash mismatch")
@@ -32,16 +30,12 @@ var (
 		"manifest would take too much memory to decode")
 )
 
-// validateUUID checks that the byte slice is a valid UUID (16 bytes, parseable).
+// validateUUID checks that the byte slice is the 16 bytes of a binary UUID.
+// Any 16 bytes are one, so the length is all there is to check.
 func validateUUID(data []byte) error {
 	if len(data) != uuidLength {
 		return errInvalidUUIDLength
 	}
-	// Try to parse as UUID to validate format
-	_, err := uuid.FromBytes(data)
-	if err != nil {
-		return errInvalidUUIDFormat
-	}
 
 	return nil
 }