chore(deps): go 1.26.5 -> 1.26.6

[lakhansamani]

What

One line in go.mod.

Why only one line

go.mod is the single source of truth for the toolchain here:

• every workflow (ci.yml, release.yaml, govulncheck.yml, buf.yml) resolves Go with go-version-file: go.mod
• the Dockerfile tracks golang:1.26-alpine3.23, i.e. the minor line, so it picks up the patch automatically
• the only other pin is e2e-playground/sdk-tests/go/Dockerfile on golang:1.25, which is deliberate and documented in-file: it matches the authorizer-go SDK's own go.mod (1.25.5), not the server's

So no workflow, image or Makefile needed touching.

Verified

go1.26.6 confirmed present in the official release index before pinning it.

go build ./...    # clean
go vet ./...      # clean
go mod tidy       # no dependency churn — diff is exactly 1 line
go test ./cmd/ ./internal/token/ ./internal/validators/   # all ok