[northtyphoon]

Objective

Upgrade the project to Go 1.27 and the latest direct dependency releases. Keep the module requirements and CI toolchain aligned, including the compatibility changes required by JWT v5.

Changes

• Require Go 1.27.3 and run the build and CodeQL workflows on Go 1.27 instead of Go 1.23/1.24.
• Upgrade CBOR from v2.8.0 to v2.9.6, JWT from v4.5.2 to v5.3.1, and x/crypto from v0.37.0 to v0.58.0. The other direct dependencies already use their latest releases.
• Adapt the remote JWT signer to the v5 raw-signature byte API and update verification-error assertions for the additional diagnostic context. Preserve the existing supported algorithms and disabled JWT claims validation.
• Refresh module checksums and remove the JWT v4 dependency.

Validation

• go test ./...: all packages pass except the existing live timestamp test, which expects an outdated DigiCert certificate subject. The same failure reproduces with the original dependencies.
• go test ./internal/timestamp -skip '^TestTimestamp$/^Timestamping_certificate_revoked$': passes.
• go vet ./...: reports existing lock-copy warnings in signature/envelope_test.go; these also reproduce with the original dependencies.
• go mod verify: passes.
• Race tests were not run because this Windows environment has CGO disabled and no C compiler available.

[Copilot]

🟢 Approval recommended

The JWT migration matches the updated API, toolchain settings are aligned, and no blocking issues were identified.

No open issues 🎉

What changed in this PR

This PR updates the module and CI toolchains to Go 1.27 and upgrades dependencies, including the JWS integration changes required by JWT v5.

Changes:

• Require Go 1.27.3 and align build and CodeQL workflows on Go 1.27.
• Upgrade CBOR, JWT, and x/crypto dependencies and refresh checksums.
• Adapt remote signing to JWT v5’s raw-signature API and update verification-error assertions.

File	Description
signature/​jws/​types.go	Switch JWT types to v5.
signature/​jws/​jwt.go	Use JWT v5 and return raw signature bytes.
signature/​jws/​jwt_test.go	Adapt the verification test to the byte-slice API.
signature/​jws/​envelope.go	Switch envelope processing to JWT v5.
signature/​jws/​envelope_test.go	Update expected JWT verification errors.
go.sum	Refresh upgraded dependency checksums.
go.mod	Raise the Go requirement and upgrade dependencies.
.github/​workflows/​reusable-codeql.yml	Run CodeQL with Go 1.27.
.github/​workflows/​reusable-build.yml	Run builds with Go 1.27.

_{Review effort: Balanced}