docs: document plural-cli security remediation ownership and fixed pins

[plural-copilot]

Summary

• document that plural-cli already pins the requested fixed Go toolchain and module versions
• note that the affected steampipe postgres plugin .so artifacts are not built from this repository
• clarify the nearest remediation path available here versus the remaining rebuild work in the owning plugin/image pipeline

Details

Repository inspection found that the repo-controlled inputs already match the requested remediations:

• Go toolchain: 1.26.4 in go.mod
• Container build/test images: golang:1.26.4 in Dockerfile, test.Dockerfile, and hack scripts
• github.com/go-git/go-git/v5: v5.19.1
• github.com/containerd/containerd: v1.7.32
• github.com/aws/aws-sdk-go-v2/service/s3: v1.97.3
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream: v1.7.8

No steampipe postgres plugin sources or build definitions were found in this repository, so the affected artifacts:

• opt/postgresql/15/lib/steampipe_postgres_aws.so
• opt/postgresql/15/lib/steampipe_postgres_azure.so
• opt/postgresql/15/lib/steampipe_postgres_gcp.so

appear to be imported from elsewhere. This PR therefore makes the smallest effective change available in plural-cli: documenting the already-remediated repo pins and the residual need to rebuild those plugin artifacts in their owning source repository or image pipeline.

Verification

• checked Docker availability locally
• verified in a Go 1.26.4 container that the module graph resolves to the expected fixed versions
• ran go test ./pkg/utils/git/... successfully in a Go 1.26.4 container
• started a broader go test ./pkg/provider/... container run; it remained in dependency download/compile work after several minutes with no observed failure before stopping

Traceability

Workbench run: https://console.plrldemo.onplural.sh/workbenches/dfccef7a-16c5-4125-9538-42f05d751b3e/jobs/24c8b29a-0272-4348-8516-14518bca056c

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create a remediation PR in pluralsh/plural-cli for actionable console-related vulnerabilities that map here from embedded CLI/plugin binaries....
🔗 Run history	View run history