ci: bump go

[cgrinds]

No description provided.

[Copilot]

Pull request overview

Updates the repository to target Go 1.27 and makes a few small code adjustments that align with newer Go/stdlib behavior and improved validation.

Changes:

• Bump Go version references to 1.27 (root + integration module + env).
• Update lint tooling version in the Justfile.
• Tighten ECDSA JWK public-key validation and adjust reflect pointer-kind usage.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
server/server.go	Updates pointer-kind check while building tool input schemas.
server/oauth.go	Strengthens EC JWK point validation using crypto/ecdh.
catalog/catalog.go	Minor refactor to initialize output maps in the struct literal.
Justfile	Bumps golangci-lint runner version used by local/CI lint tasks.
go.mod	Bumps module Go version directive to 1.27.
integration/go.mod	Bumps integration module Go version directive to 1.27.
.go.env	Updates GO_VERSION used by automation to 1.27.0.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (3)

server/oauth.go:495

• The new length validation error message doesn’t quote the curve value, while other errors in this function use %q. Quoting avoids ambiguity (especially if the value contains unexpected characters) and keeps messaging consistent.

		return nil, fmt.Errorf("EC coordinates must each be %d bytes for curve %s", byteLen, k.Crv)

server/oauth.go:497

• This change tightens ECDSA JWK parsing semantics (fixed coordinate lengths + ParseUncompressedPublicKey). There are existing JWKS/oauth tests, but none cover EC JWKs; add unit tests for valid P-256/P-384/P-521 keys, leading-zero coordinates, wrong-length coordinates, and an invalid point to ensure the new validation behavior is stable.

	byteLen := (curve.Params().BitSize + 7) / 8
	if len(xBytes) != byteLen || len(yBytes) != byteLen {
		return nil, fmt.Errorf("EC coordinates must each be %d bytes for curve %s", byteLen, k.Crv)
	}

server/oauth.go:493

• PR title suggests this is only a Go/CI bump, but this also changes runtime behavior in JWT/JWKS ECDSA key parsing. Consider updating the PR title/description (or splitting) so reviewers and release notes capture the functional/security-impacting change.

	byteLen := (curve.Params().BitSize + 7) / 8