fix: remediate Harbor dependency vulnerabilities

[yuzichen12123]

Summary

• Update github.com/Azure/go-ntlmssp in subtree/harbor/src.
• Update GOLANG_IMAGE_VERSION from 1.26.2 to 1.26.3 in Tekton and patch scripts.
• Keep Photon base image unchanged for now; a follow-up PR will update it after a fixed Photon tag is published.

Verification

• GOTOOLCHAIN=auto GOPROXY=https://proxy.golang.org,direct go test ./... in subtree/harbor/src was attempted and stopped at github.com/goharbor/harbor/src/common/dao because POSTGRESQL_HOST is not set.
• Non-testing go.mod scan: only LOW github.com/jackc/pgx/v4 CVE-2026-41889 remains, with no fixed version in Trivy DB.

[Tongcaiyun]

/lgtm

[edge-katanomi-app2]

✅ LGTM Status - Ready to Merge

This PR has received 1/1 valid LGTM approvals and meets the approval threshold.

LGTM Summary:

User	Permission	Valid
@Tongcaiyun	read	✅

The PR is now ready for merge! 🎉

⚠️ Check Runs Status - Some checks are not passing

Check Name	Status
Pipelines as Code CI / harbor-all-in-one	failure

Note: All checks must pass before this PR can be merged.