chore: bump Go toolchain to 1.27.2 and fix govulncheck findings

govulncheck reported 10 called standard-library vulnerabilities on go1.26.6. Bumping the toolchain to 1.27.2 clears them. Upgrading golang.org/x/crypto (v0.58.0) and golang.org/x/net (v0.61.0) clears the package- and module-level findings that have a fix.

golangci-lint v2.11.4 refuses to lint a module targeting Go 1.27, so it moves to v2.15.0 in both mise and the lint workflow.