[client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys (#8326)

* [client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys

Eight eMudhra intermediate CA private keys were compromised and browsers
blocked them on 2026-10-17. Our binaries were built with go1.26.7, which
accepts chains through those intermediates whenever the trust store still
holds emSign ECC Root CA - G3. go1.26.10 rejects them in crypto/x509 on
every platform, regardless of the trust store.

The UBI base still ships the root and Red Hat has no fixed package yet, so
the UBI images blocklist it with p11-kit. The ingest image, the UI server
image and the pinned Chainguard digests also carried the root and move to
bases that no longer do.

* [client,proxy,management,signal,relay] Use the fixed UBI base instead of a blocklist

Red Hat shipped ca-certificates 2026.2.92_v9.0.319-90.3 on 2026-10-22,
which drops emSign ECC Root CA - G3 and AAA Certificate Services. The
current ubi9-minimal image carries it, so pin that digest and remove the
p11-kit blocklist step.

* [misc] Pin upload-server images by digest only and restore go.mod comment

client/ui/build/docker/Dockerfile.cross

@@ -13,7 +13,7 @@
 #   docker run --rm -v $(pwd):/app wails-cross windows amd64
 #   docker run --rm -v $(pwd):/app wails-cross windows arm64
 
-FROM golang:1.26.7-bookworm
+FROM golang:1.26.10-bookworm
 
 ARG TARGETARCH
 

client/ui/build/docker/Dockerfile.server

@@ -2,7 +2,7 @@
 # Multi-stage build for minimal image size
 
 # Build stage
-FROM golang:1.26.7-alpine AS builder
+FROM golang:1.26.10-alpine AS builder
 
 WORKDIR /app
 
@@ -22,7 +22,7 @@ RUN go mod tidy
 RUN go build -tags server -ldflags="-s -w" -o server .
 
 # Runtime stage - minimal image
-FROM gcr.io/distroless/static-debian12
+FROM gcr.io/distroless/static-debian13
 
 # Copy the binary
 COPY --from=builder /app/server /server