Update Go toolchain to 1.25.11

[Copilot]

Trivy reports stdlib CVEs in binaries built with Go 1.25.10, fixed in Go 1.25.11 / 1.26.4. This updates the project to the patched 1.25.x toolchain.

• Go module

  • Bump go.mod from go 1.25.10 to go 1.25.11.

• CI workflows

  • Update GitHub Actions setup-go references to 1.25.11.
  • Align release, style, Trivy, bookie, package, and function checks on the patched Go version.

• Docker test environment

  • Update the test Docker image Go source from golang:1.25.10-alpine to golang:1.25.11-alpine.

go 1.25.11

[github-actions]

@Copilot:Thanks for your contribution. For this PR, do we need to update docs?
(The PR template contains info about doc, which helps others know more about the changes. Can you provide doc-related info in this and future PR descriptions? Thanks)

[Copilot]

@copilot:Thanks for your contribution. For this PR, do we need to update docs?
(The [PR template contains info about doc](https://github.com/apache/pulsar/blob/master/.github/PULL_REQUEST_TEMPLATE.md#...

This PR fixes stdlib CVEs reported by Trivy for Go 1.25.10 by moving to Go 1.25.11:

• CVE-2026-42504
• CVE-2026-27145
• CVE-2026-42507

Docs update: not required; this is a build/toolchain security update and does not change user-facing pulsarctl behavior.