fix(deps): corrige CVEs HIGH/CRITICAL que bloqueavam o release

O scan Trivy do CI falhou no push anterior e impediu a publicacao das
imagens, entao a producao seguiu na versao antiga.

- webmail: next 15.5.21 -> 15.5.27 (RCE no otimizador de imagens e
  cache poisoning), sharp -> 0.35.5, source-map-js -> 1.2.2,
  dompurify -> 3.4.17
- protocols: golang.org/x/net 0.58 -> 0.60 (DoS HTTP/2) e toolchain
  Go 1.25 -> 1.26 (stdlib corrigida a partir de 1.26.9)

Verificado localmente: imagens e repositorio sem achados HIGH/CRITICAL,
testes e build verdes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/protocols/go.mod

@@ -1,6 +1,6 @@
 module lambdamail/protocols
 
-go 1.25.0
+go 1.26.0
 
 require (
 	blitiri.com.ar/go/spf v1.5.1
@@ -16,7 +16,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/miekg/dns v1.1.72
-	golang.org/x/crypto v0.55.0
+	golang.org/x/crypto v0.57.0
 )
 
 require (
@@ -27,10 +27,10 @@ require (
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect
-	golang.org/x/mod v0.40.0 // indirect
-	golang.org/x/net v0.58.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	golang.org/x/tools v0.49.0 // indirect
 )