resolve govulncheck CVE with golang update

[nathanlaceyraft]

Install same version of go that is used by dockerfile. (1.22.2)

within d2 top folder run
govulncheck ./...

You'll see vulnerabilities like

Vulnerability #2: GO-2025-3420
Sensitive headers incorrectly sent after cross-domain redirect in net/http
More info: https://pkg.go.dev/vuln/GO-2025-3420
Standard library
Found in: net/http@go1.23.4
Fixed in: net/http@go1.23.5
Example traces found:
#1: lib/imgbundler/imgbundler.go:213:28: imgbundler.httpGet calls http.Client.Do
#2: lib/png/png.go:66:27: png.InitPlaywright calls playwright.Install, which eventually calls http.Get

Vulnerability #3: GO-2025-3373
Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
More info: https://pkg.go.dev/vuln/GO-2025-3373
Standard library
Found in: crypto/x509@go1.23.4
Fixed in: crypto/x509@go1.23.5
Example traces found:
#1: lib/urlenc/urlenc.go:45:22: urlenc.Decode calls io.Copy, which eventually calls x509.Certificate.Verify
#2: lib/urlenc/urlenc.go:45:22: urlenc.Decode calls io.Copy, which eventually calls x509.Certificate.VerifyHostname
#3: cmd/d2plugin-dagre/main.go:12:12: d2plugin.main calls xmain.Main, which eventually calls x509.HostnameError.Error
#4: lib/urlenc/urlenc.go:45:22: urlenc.Decode calls io.Copy, which eventually calls x509.ParseCertificate

[alixander]

Thank you

[alixander]

@nathanlaceyraft Could you sign your commit please? We have it as an org-wide setting.

[nathanlaceyraft]

Thanks for reminding me to set that up!