fix: eliminate Go security findings and harden file handling

[keller0]

Summary

• upgrade Go version directive to 1.25.12 to pull in patched standard-library security fixes
• upgrade direct dependencies to latest stable (cobra)
• remove gin stack and refactor HTTP server to standard library net/http
• remove the transitive gin -> validator -> golang.org/x/crypto dependency chain that kept surfacing module-level security warnings
• add server-side file name sanitization to prevent path traversal style inputs on upload/delete
• add mutex protection for shared in-memory state accessed by concurrent requests

Why

Repository security checks initially showed reachable vulnerabilities and additional module warnings. After dependency upgrades there was still an unfixed module-level advisory tied to golang.org/x/crypto/openpgp in transitive dependencies. Replacing gin with standard library handlers removes that dependency chain entirely and reduces attack surface.

Changes

• http.go
  • replaced gin routes with net/http handlers for /, /submit, /clearAll, /deleteFile, /upload, static routes
  • added sanitizeFileName validation for upload/delete file names
  • added JSON helper and template render helper
  • added sync.RWMutex to guard shared state (sData, imgList, fileList)
• go.mod
  • removed gin and all related transitive web stack modules
  • retained only cobra direct dependency
• go.sum
  • regenerated to match reduced dependency graph

Validation

• go test ./...
• govulncheck ./...
• govulncheck -show verbose ./...

All validation commands pass and govulncheck reports No vulnerabilities found.