Bump Go to 1.26.9 and patch known vulnerabilities

- go directive and .go-version 1.26.5 -> 1.26.9 in all 14 modules
  (clears Go stdlib advisories in net/http, crypto/tls, html/template,
  net/textproto, encoding/xml, encoding/asn1, net/url)
- golang.org/x/net v0.58.0 -> v0.60.0
- aws plugin: aws-sdk-go-v2 eventstream v1.7.8, s3 v1.97.3

govulncheck: 0 reachable vulnerabilities across all modules.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

api/go.mod

@@ -1,6 +1,6 @@
 module github.com/hashicorp/boundary/api
 
-go 1.26.5
+go 1.26.9
 
 require (
 	github.com/coder/websocket v1.8.14