fix(security): build the scanner image with the Go go.mod requires

go.mod moved to go 1.27.3 in 775b2b0b, but the OSS Scanner image still started
from golang:1.27.2 with GOTOOLCHAIN=local, so its build refused the module.

.oss-scanner/Dockerfile

@@ -4,7 +4,7 @@
 
 FROM node:26-trixie-slim AS node
 
-FROM golang:1.27.2-trixie
+FROM golang:1.27.3-trixie
 
 ENV DEBIAN_FRONTEND=noninteractive \
     CGO_ENABLED=1 \