Update tool dependencies and fix new lint issues

[silverwind]

Summary

• Update golangci-lint v2.9.0 → v2.10.1, misspell v0.7.0 → v0.8.0, actionlint v1.7.10 → v1.7.11
• Fix 20 new QF1012 staticcheck findings by using fmt.Fprintf instead of WriteString(fmt.Sprintf(...))
• Fix SA1019: replace deprecated ecdsa.PublicKey field access with PublicKey.Bytes() for JWK encoding, with SEC 1 validation and curve derived from signing algorithm
• Add unit test for ToJWK() covering P-256, P-384, and P-521 curves, also verifying correct coordinate padding per RFC 7518
• Remove dead staticcheck linter exclusion for "argument x is overwritten before first use"

Test plan

• make lint-go passes with 0 issues
• go test ./services/oauth2_provider/ -run TestECDSASigningKeyToJWK passes for all curves

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates repository tooling (lint-related dependencies) and applies code changes needed to satisfy new linter/staticcheck findings, including a crypto/JWK update for ECDSA keys used by the OAuth2/OIDC provider.

Changes:

• Bump lint tool dependencies in the Makefile (golangci-lint, misspell, actionlint).
• Replace WriteString(fmt.Sprintf(...)) patterns with fmt.Fprintf(...) across multiple string/buffer builders to address new linter findings.
• Update ECDSA JWK encoding to use SEC 1 uncompressed point bytes (avoiding deprecated field access and preserving leading zeros), and add unit coverage for P-256/P-384/P-521.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
services/webhook/wechatwork.go	Use fmt.Fprintf to build commit text (lint fix).
services/webhook/telegram.go	Use fmt.Fprintf for commit list formatting (lint fix).
services/webhook/slack.go	Use fmt.Fprintf for attachment text (lint fix).
services/webhook/msteams.go	Use fmt.Fprintf for commit text (lint fix).
services/webhook/matrix.go	Use fmt.Fprintf when building Matrix HTML content (lint fix).
services/webhook/feishu.go	Use fmt.Fprintf for header text (lint fix).
services/webhook/discord.go	Use fmt.Fprintf for commit text (lint fix).
services/release/notes.go	Use fmt.Fprintf when building release notes (lint fix).
services/oauth2_provider/jwtsigningkey.go	Change ECDSA ToJWK() to derive coordinates from SEC 1 bytes and map curve name from coordinate length.
services/oauth2_provider/jwtsigningkey_test.go	Add unit test verifying JWK output for P-256/P-384/P-521 (including fixed coordinate sizes).
services/gitdiff/gitdiff.go	Use fmt.Fprintf for synthetic patch header generation (lint fix).
routers/web/repo/setting/lfs.go	Use fmt.Fprintf while building LFS file HTML fragments (lint fix).
modules/git/foreachref/format.go	Use fmt.Fprintf when composing git for-each-ref format flag (lint fix).
models/repo/repo.go	Use fmt.Fprintf for repository size details string formatting (lint fix).
Makefile	Bump lint tool dependency versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[silverwind]

Posted by @silverwind's AI assistant (Claude)

Did an in-depth validation of the ToJWK() changes:

• ecdsa.PublicKey.Bytes() is guaranteed to return uncompressed SEC 1 format (0x04 || X || Y) — Go's implementation internally uses FillBytes which always produces fixed-length zero-padded coordinates. There is no compressed point code path.
• The 0x04 prefix and length checks are defensive sanity checks that shouldn't trigger for well-formed keys but are good practice.
• The old code using big.Int.Bytes() had a latent bug: it strips leading zero bytes, so ~1/256 of the time a coordinate would be one byte short, violating RFC 7518's requirement that coordinates "MUST be the full size of a coordinate for the curve." This is the same class of bug as keycloak/keycloak#14933. The new code fixes this.
• Coordinate lengths are correct: P-256=32, P-384=48, P-521=66 (ceil(bitSize/8)).
• base64.RawURLEncoding produces unpadded base64url, matching the JOSE/RFC 7518 specification.
• Curve is now derived from the JWT signing algorithm (ES256/ES384/ES512) instead of being inferred from coordinate length, avoiding potential ambiguity.