Upgrade runtime toolchains and gate releases on image security

[davidvanleeuwen]

The existing Go-built runtime binaries retain vulnerable standard-library code, and the Elixir/OTP toolchain needs an update. Upgrade Go to 1.27.2 and Elixir/OTP to 1.20.4/29.1.1 across builds, CI and local version pins; remove the unused Pebble binary from the runtime image and install the OTP SCTP runtime dependency.

Preserve streamed encoder ZIP compatibility with OTP 29's wrapped metadata error, with a regression test confirming corrupted entries remain rejected. Update the deprecated File.stream! argument order. Pin Trivy and run image scans on relevant pull requests and as a release prerequisite.

Validation:

• 1,195 Core tests passed locally, plus encoder/broker Go tests and vet, formatting, Credo and security checks.
• Local ARM64 Core, CPU encoder and GPU image builds succeeded; HIGH/CRITICAL Trivy scans returned zero findings for these images.
• Workflow validation passed with actionlint.

Limits: GPU hardware execution and Linux AMD64 CI remain to be verified. Updating the MinIO builder's Go toolchain does not resolve its 47 upstream dependency findings (41 HIGH, 6 CRITICAL); MinIO is not part of the Core/encoder image scan matrix.