fix(security): bump golang.org/x/mod to 0.40.0 for CVE-2026-56864/56865 (#3215)