all: refresh project infrastructure (#490)

Require Go 1.25, and test against 1.25 and 1.26. Upgrade to golangci-lint
v2, and to current versions of the workflow actions and bootstrap tools.
Replace the `deps` workflow with dependabot for module dependencies.

The signature and textflag generators take an explicit random source,
since `math/rand.Seed` is a no-op from Go 1.24.

Third-party tests move the `golang/go` entry to go1.26.5 and gain a
`toolchain` option, so a package's steps can run with a Go toolchain
built from the checkout. `dgryski/go-bloomindex` is skipped pending an
upstream fix (#494). Metadata tests use the automatic GitHub token, which
is available on pull requests from forks.

Co-authored-by: Michael McLoughlin <mmcloughlin@gmail.com>