Bump Go to 1.25.3 ⬆️

[cthach]

Changelog: Updated Go to 1.25.3.

Skipped Go 1.25.2 because it had breaking changes. Go 1.25.3 reverts those breaking changes while including most of security/bug fixes.

Will be manually backported to previous release branches since they require Go 1.24.x.

[espadolini]

golang/go#75828 (comment) this will completely break clusters whose name is longer than 31 characters, let's wait and hope they relax the checks?

[cthach]

golang/go#75828 (comment) this will completely break clusters whose name is longer than 31 characters, let's wait and hope they relax the checks?

I'm good with holding off. Btw, here are the full validation rules:

// domainNameValid does minimal domain name validity checking. In particular it
// enforces the following properties:
//   - names cannot have the trailing period
//   - names can only have a leading period if constraint is true
//   - names must be <= 253 characters
//   - names cannot have empty labels
//   - names cannot labels that are longer than 63 characters

Besides empty names and clusters with long names, what other rules affect us? Would be good to know

[cthach]

Pausing this update for now until a new Go version is released.

[espadolini]

what other rules affect us?

The only one we were aware of was the long labels (#52508), I don't think we considered the implications empty SANs until now.

[cthach]

Looks like the DNS SANs validation is being relaxed after causing breakage: https://go-review.googlesource.com/c/go/+/710735

I'll wait for it to get pulled into a release before I continue with the updating.