CLSA-2026-1774996482 golang: Fix of CVE-2026-25679

CVE-2026-25679: fix insufficient validation of host/authority in url.Parse that allowed invalid URLs; strengthen parsing and reject malformed host and authority components - fix-smtp-test-expired-cert: fix expired TLS test certificate in net/smtp tests; replace with upstream long-lived cert...