CVE-2026-97041: Go toolchain: Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external…

Building a malicious package containing "//go:cgo" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgoimportdynamic", "//go:cgoexportdynamic", "//go:cgoexportstatic",...