chore: let go-make own the go version (#5464)

* chore: let go-make own the go version

Drops syft's own Go version pin so CI and releases use go-make setup's default. The pin predates the go-make port (#4773, carried through #4923) and had to be kept in sync in four places.

- removes the `go-version` input from `.github/actions/bootstrap` and the three `go-version: "1.26.2"` overrides in `validations.yaml`
- builds move from Go 1.26 to go-make's default (currently `1.27.2`). `go.mod` stays at `go 1.26.8`, so nothing changes for library consumers
- this is groundwork for the emSign/eMudhra CA fix: Go `1.27.3` distrusts the compromised intermediates in `crypto/x509`. anchore/go-make#170 bumps the default, and the go-make pin here gets bumped once that is released. The `v1.55.0` images also still carry `emSign ECC Root CA - G3`, so a release is needed after the bump

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* chore: reformat generated license list with go 1.27 gofmt

go 1.27 gofmt aligns long map keys differently, so the json schema drift check rewrote this file.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

.github/actions/bootstrap/action.yaml

@@ -6,10 +6,6 @@ description: "Bootstrap all syft tools and dependencies on top of go-make's setu
 # We add the syft-specific extras here: apt packages and the test fixture cache.
 
 inputs:
-  go-version:
-    description: "Go version to install (passed to go-make/setup)"
-    required: true
-    default: "1.26.2"
   cache-key-prefix:
     description: "Prefix all cache keys with this value (passed to go-make/setup)"
     required: true
@@ -32,7 +28,6 @@ runs:
     - name: Setup go + go-make tooling
       uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
       with:
-        go-version: ${{ inputs.go-version }}
         cache-key-prefix: ${{ inputs.cache-key-prefix }}
         cache-enabled: ${{ inputs.cache-enabled }}
 

.github/workflows/validations.yaml

@@ -100,9 +100,6 @@ jobs:
       # are unavailable here (`make unit` skips the fixture refresh on windows)
       - name: Setup go + go-make tooling
         uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
-        with:
-          # keep in sync with the go-version default in ./.github/actions/bootstrap
-          go-version: "1.26.2"
 
       # the binny-free version of `make download-test-fixture-cache` (keep the oras version in sync with .binny.yaml)
       - name: Download test fixture cache
@@ -196,9 +193,6 @@ jobs:
       # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary
       - name: Setup go + go-make tooling
         uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
-        with:
-          # keep in sync with the go-version default in ./.github/actions/bootstrap
-          go-version: "1.26.2"
 
       - name: Install Podman
         run: |
@@ -229,9 +223,6 @@ jobs:
       # go-make's setup only (not ./.github/actions/bootstrap): the test only needs make + the snapshot binary
       - name: Setup go + go-make tooling
         uses: anchore/go-make/.github/actions/setup@abf41688f36f2cbec13105747abbe8e60f5c56ca # v0.9.3
-        with:
-          # keep in sync with the go-version default in ./.github/actions/bootstrap
-          go-version: "1.26.2"
 
       - name: Install Buildah
         run: |