fix(security): bump Go stdlib go1.26.5 → go1.26.6

Addresses four stdlib vulnerabilities confirmed by govulncheck:
- GO-2026-6218: Quadratic complexity in net/url.resolvePath
- GO-2026-6090: Unbounded post-handshake messages in crypto/tls
- GO-2026-5972: Max recursion depth in encoding/asn1
- GO-2026-5026: Punycode-encoded label rejection in net/http

Related: SRVKP-13176

Co-Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: divyansh42

go.mod

@@ -1,6 +1,6 @@
 module github.com/tektoncd/cli
 
-go 1.26.5
+go 1.26.6
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7