fix(security): build harbor-cli with Go 1.26.3

[dancer430]

Summary

• Bump the root Go directive from 1.26.2 to 1.26.3 so Dagger release builds use golang:1.26.3-alpine for all harbor-cli artifacts.
• Keep .dagger/go.mod on Go 1.26.2 because Dagger v0.20.8 codegen currently rejects Go 1.26.3 in the Dagger module (highest supported version is 1.26.2). The release build still reads the root go.mod, so the released binaries are built with Go 1.26.3.
• Replace reflect.Ptr with reflect.Pointer to satisfy the Go 1.26.3 govet/golangci-lint checks. This is a compatibility cleanup required after the Go toolchain bump, not part of the vulnerability fix itself; the two names represent the same reflect.Kind value.

Why

The v0.0.18-alauda-8 release binaries are built with Go 1.26.2. Trivy reports fixed Go stdlib CVEs requiring Go 1.26.3.

Verification

• PR GitHub Actions passed: lint, test-code, vulnerability-check.
• GOTOOLCHAIN=auto go test ./...
• GOTOOLCHAIN=go1.26.3 go vet ./...
• GOTOOLCHAIN=go1.26.3 go run golang.org/x/vuln/cmd/govulncheck@latest ./...
• Built and released a fork verification artifact from the same commit: https://github.com/dancer430/harbor-cli/releases/tag/v0.0.18-alauda-9
• Verified harbor-cli_0.0.18-alauda-9_linux_amd64.tar.gz: go version -m reports go1.26.3.
• Trivy scan against the linux/amd64 binary packaged into a scratch image reports no fixed vulnerabilities: [].

[dancer430]

Validation update for this PR:

• GitHub Actions on PR head f7992a4 all passed: lint, test-code, vulnerability-check.
• Local checks passed: GOTOOLCHAIN=auto go test ./..., GOTOOLCHAIN=go1.26.3 go vet ./..., GOTOOLCHAIN=go1.26.3 govulncheck ./....
• I also built a fork release from the same commit for verification: https://github.com/dancer430/harbor-cli/releases/tag/v0.0.18-alauda-9
• Verified harbor-cli_0.0.18-alauda-9_linux_amd64.tar.gz: go version -m reports go1.26.3.
• Trivy scan against the linux/amd64 binary packaged into a scratch image reports no fixed vulnerabilities: [].

Once this PR is reviewed and merged into alauda-v0.0.18, the upstream auto-tag workflow should produce the official v0.0.18-alauda-9 release under AlaudaDevops/harbor-cli.