Raise Go to the latest release, update dependencies, use the standard library uuid, add a vulnerability check (closes #102)

Go 1.27.1 in go.mod and in the Dockerfile's test and build images.
Every module go.mod requires is at its current release; protoc-gen-go
follows protobuf to v1.36.12 and mf.pb.go is regenerated. The standard
library uuid package replaces github.com/google/uuid; FromBytes could
only fail on a length validateUUID already checks, so that call and its
unreachable error are gone. make vulncheck runs govulncheck v1.8.0,
installed with go install at its release commit, in a vulncheck stage
of the Dockerfile; script/check does not run it. The newer go directive
switches on lint checks for strings.SplitSeq and t.Chdir, now used. A
new test pins the bytes of a seeded manifest written by an mfer built
before this change.

Model: opus-5-5

mfer/serialize.go

@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"math"
 	"time"
+	"uuid"
 
-	"github.com/google/uuid"
 	"github.com/klauspost/compress/zstd"
 	"google.golang.org/protobuf/proto"
 )
@@ -88,7 +88,7 @@ func (m *manifest) generateOuter(ctx context.Context) error {
 	if len(m.fixedUUID) == uuidLength {
 		copy(manifestUUID[:], m.fixedUUID)
 	} else {
-		manifestUUID = uuid.New()
+		manifestUUID = uuid.NewV4()
 	}
 
 	m.pbInner.Uuid = manifestUUID[:]