fix(security): resolve Xray CVE violations (nanoid whitelist + Go 1.26.6 bump) (#3206)