Rebuild with Go 1.27.2 or later and a newer pdfcpu (HIGH CVEs in stdlib, x/net, x/crypto, x/image, x/text) #1695

Trivy reports HIGH vulnerabilities with an available fix in the gotenberg and pdfcpu binaries of the Gotenberg image.

Scan of gotenberg:8.37.0 (Debian 13.6), trivy k8s --scanners vuln --ignore-unfixed:

I did not scan the 8.38.x images. On v8.38.1 and main, build/Dockerfile sets ARG GOLANG_VERSION=1.27.1 and ARG PDFCPU_VERSION=v0.15.0, the same as 8.37.0 for these two, so the findings should be the same.

Go 1.27.3 is the current stable release (https://go.dev/dl/). pdfcpu v0.15.0 pins x/crypto v0.54.0, x/image v0.44.0 and x/text v0.40.0 in its go.mod. pdfcpu v0.16.3 pins x/crypto v0.58.0, x/image v0.47.0 and x/text v0.43.0, which are all above the fixed versions.

go.mod on v8.38.1 has golang.org/x/net v0.59.0, below the 0.60.0 fix. PR #1687 bumps it to 0.61.0.

Proposed fix: set GOLANG_VERSION to 1.27.3 (or at least 1.27.2), set PDFCPU_VERSION to v0.16.3 or later, merge #1687, and publish a release.

Related: #1649 (CVE fix release request) and #1678 (rebuild on Debian security fixes).