Raise Go to the latest release, update dependencies, use the standard library uuid, add a vulnerability check (closes #102)

Go 1.27.1 in go.mod and in the Dockerfile's test and build images.
Every module go.mod requires is at its current release; protoc-gen-go
follows protobuf to v1.36.12 and mf.pb.go is regenerated. The new
standard library uuid package replaces github.com/google/uuid; the
FromBytes call could only fail on a length validateUUID already checks,
so it and its unreachable error are gone. make vulncheck runs
govulncheck v1.8.0, installed with go install at its release commit, in
a vulncheck stage of the Dockerfile on the digest-pinned golang image;
script/check does not run it. A new test pins the bytes of a seeded
manifest written by an mfer built before this change.

Model: opus-5-5

internal/cli/fetch_test.go

@@ -19,8 +19,8 @@ import (
 	"sync/atomic"
 	"testing"
 	"time"
+	"uuid"
 
-	"github.com/google/uuid"
 	"github.com/klauspost/compress/zstd"
 	"github.com/multiformats/go-multihash"
 	"github.com/spf13/afero"