fix: bump Go version from 1.26.5 to 1.26.9 (#30807)

Bump the Go toolchain from 1.26.5 to 1.26.9 ([released
2026-10-02](https://go.dev/doc/devel/release#go1.26.9)).

Tracked in Linear:
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29).
Iron Bank fix-by date for the Critical finding is **2026-10-29**.

Go 1.26.9 includes fixes for the findings Iron Bank reported against
`coder/coder-enterprise/coder-service-2:2.38.0`. Of the 19 still-valid
advisories, 12 are only fixed in 1.26.9, including the Critical one:

- Critical: [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) /
CVE-2026-78663 (HTTP/2 server double flow-control refund)
- High: GO-2026-6603, -6605, -6607, -6608, -6609, -6610, -6611, -6613
- Low: GO-2026-6599, -6600, -6617

The other 7 (GO-2026-5026, -5942, -6088, -6089, -6090 High; -6091, -6218
Medium) are fixed since 1.26.6. The full list with links is in ENT-210.

## Changes

Same file set as #27157:

- `go.mod`: `go 1.26.5` to `go 1.26.9`
- `mise.toml` / `mise.lock`: Go toolchain pin and the archive URLs and
SHA-256 checksums for each platform (taken from the official `go.dev/dl`
release list)

## Verification

- `go build ./enterprise/cmd/coder` with go1.26.9 succeeds; `go mod tidy
-diff` is clean.
- `govulncheck -mode binary` on the resulting binary reports none of the
19 advisories above. The same scan of the released 2.38.0 binary
(go1.26.5) reports all 19.

## Not in this PR

`golang.org/x/net` v0.60.0 (the module-side half of GO-2026-6603, -6610,
-6611, -6612 and -6617) is already on `main` via #30772 and is
backported to the release branches in #30814 (2.38), #30815 (2.37),
#30816 (2.36), #30817 (2.35) and #30818 (2.34), tracked in
[ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix).
The Go 1.27.1 bump (#30288) stays a separate, larger change. Go
backports: #30808 (2.38), #30809 (2.37), #30810 (2.36), #30813 (2.35),
#30811 (2.34).

Opened by Superblink on behalf of @droopy4096.

go.mod

@@ -1,6 +1,6 @@
 module github.com/coder/coder/v2
 
-go 1.26.5
+go 1.26.9
 
 // Required until a v3 of chroma is created to lazily initialize all XML files.
 // None of our dependencies seem to use the registries anyways, so this

mise.lock

@@ -433,52 +433,52 @@ checksum = "sha256:e1245a0a760a45b236e7a25bf118c1defc8447734bdeb4260ea3ec15d1797
 url = "https://github.com/digitalocean/doctl/releases/download/v1.158.0/doctl-1.158.0-windows-amd64.zip"
 
 [[tools.go]]
-version = "1.26.5"
+version = "1.26.9"
 backend = "core:go"
 
 [tools.go."platforms.linux-arm64"]
-checksum = "sha256:fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49"
-url = "https://dl.google.com/go/go1.26.5.linux-arm64.tar.gz"
+checksum = "sha256:4a97373d49fcacdcf3694fea368a500b00ee3e963974f3e7514132717632f052"
+url = "https://dl.google.com/go/go1.26.9.linux-arm64.tar.gz"
 
 [tools.go."platforms.linux-arm64-musl"]
-checksum = "sha256:fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd696d49"
-url = "https://dl.google.com/go/go1.26.5.linux-arm64.tar.gz"
+checksum = "sha256:4a97373d49fcacdcf3694fea368a500b00ee3e963974f3e7514132717632f052"
+url = "https://dl.google.com/go/go1.26.9.linux-arm64.tar.gz"
 
 [tools.go."platforms.linux-x64"]
-checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
-url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
+checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d"
+url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz"
 
 [tools.go."platforms.linux-x64-baseline"]
-checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
-url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
+checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d"
+url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz"
 
 [tools.go."platforms.linux-x64-musl"]
-checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
-url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
+checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d"
+url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz"
 
 [tools.go."platforms.linux-x64-musl-baseline"]
-checksum = "sha256:5c2c3b16caefa1d968a94c1daca04a7ca301a496d9b086e17ad77bb81393f053"
-url = "https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz"
+checksum = "sha256:42d158b4d8f7b61ac0a830567c940a86098fb7aac52e467a5ebec03ef5cc2f8d"
+url = "https://dl.google.com/go/go1.26.9.linux-amd64.tar.gz"
 
 [tools.go."platforms.macos-arm64"]
-checksum = "sha256:efb87ff28af9a188d0536ef5d42e63dd52ba8263cd7344a993cc48dd11dedb6a"
-url = "https://dl.google.com/go/go1.26.5.darwin-arm64.tar.gz"
+checksum = "sha256:f9bb7c0a02506c5d9bf0d1eb1f7ee6c7684f844ae49558308a0427b830e022cc"
+url = "https://dl.google.com/go/go1.26.9.darwin-arm64.tar.gz"
 
 [tools.go."platforms.macos-x64"]
-checksum = "sha256:6231d8d3b8f5552ec6cbf6d685bdd5482e1e703214b120e89b3bf0d7bf1ef725"
-url = "https://dl.google.com/go/go1.26.5.darwin-amd64.tar.gz"
+checksum = "sha256:00c29e3d4c8562f547410daa18d2959b641bd691ab00c4a525ea817a0253d4bd"
+url = "https://dl.google.com/go/go1.26.9.darwin-amd64.tar.gz"
 
 [tools.go."platforms.macos-x64-baseline"]
-checksum = "sha256:6231d8d3b8f5552ec6cbf6d685bdd5482e1e703214b120e89b3bf0d7bf1ef725"
-url = "https://dl.google.com/go/go1.26.5.darwin-amd64.tar.gz"
+checksum = "sha256:00c29e3d4c8562f547410daa18d2959b641bd691ab00c4a525ea817a0253d4bd"
+url = "https://dl.google.com/go/go1.26.9.darwin-amd64.tar.gz"
 
 [tools.go."platforms.windows-x64"]
-checksum = "sha256:97e6b2a833b6d89f9ff17d25419ac0a7e3b482a044e9ab18cdef834bd834fd38"
-url = "https://dl.google.com/go/go1.26.5.windows-amd64.zip"
+checksum = "sha256:d722201a9c0c086d1610e111c48203009af690892ed708072bd5ae20160e7a59"
+url = "https://dl.google.com/go/go1.26.9.windows-amd64.zip"
 
 [tools.go."platforms.windows-x64-baseline"]
-checksum = "sha256:97e6b2a833b6d89f9ff17d25419ac0a7e3b482a044e9ab18cdef834bd834fd38"
-url = "https://dl.google.com/go/go1.26.5.windows-amd64.zip"
+checksum = "sha256:d722201a9c0c086d1610e111c48203009af690892ed708072bd5ae20160e7a59"
+url = "https://dl.google.com/go/go1.26.9.windows-amd64.zip"
 
 [[tools."go:github.com/coder/paralleltestctx/cmd/paralleltestctx"]]
 version = "0.0.2"

mise.toml

@@ -9,7 +9,7 @@ lockfile = true
 [tools]
 # Languages and runtimes.
 bun = "1.2.15"
-go = "1.26.5"
+go = "1.26.9"
 node = "22.19.0"
 pnpm = "10.33.2"