fix(deps): corrige CVEs HIGH/CRITICAL que bloqueavam o release

O scan Trivy do CI falhou no push anterior e impediu a publicacao das
imagens, entao a producao seguiu na versao antiga.

- webmail: next 15.5.21 -> 15.5.27 (RCE no otimizador de imagens e
  cache poisoning), sharp -> 0.35.5, source-map-js -> 1.2.2,
  dompurify -> 3.4.17
- protocols: golang.org/x/net 0.58 -> 0.60 (DoS HTTP/2) e toolchain
  Go 1.25 -> 1.26 (stdlib corrigida a partir de 1.26.9)

Verificado localmente: imagens e repositorio sem achados HIGH/CRITICAL,
testes e build verdes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/webmail/package.json

@@ -14,7 +14,7 @@
     "dompurify": "^3.4.14",
     "framer-motion": "^11.18.2",
     "lucide-react": "^0.474.0",
-    "next": "15.5.21",
+    "next": "15.5.27",
     "qrcode-generator": "^2.0.4",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",