GeezerVison

Bump the Go toolchain from 1.26.5 to 1.26.9 ([released
2026-10-02](https://go.dev/doc/devel/release#go1.26.9)).

Tracked in Linear:
[ENT-210](https://linear.app/codercom/issue/ENT-210/ironbank-critical-bump-go-to-1269-fix-by-2026-10-29).
Iron Bank fix-by date for the Critical finding is **2026-10-29**.

Go 1.26.9 includes fixes for the findings Iron Bank reported against
`coder/coder-enterprise/coder-service-2:2.38.0`. Of the 19 still-valid
advisories, 12 are only fixed in 1.26.9, including the Critical one:

- Critical: [GO-2026-6612](https://pkg.go.dev/vuln/GO-2026-6612) /
CVE-2026-78663 (HTTP/2 server double flow-control refund)
- High: GO-2026-6603, -6605, -6607, -6608, -6609, -6610, -6611, -6613
- Low: GO-2026-6599, -6600, -6617

The other 7 (GO-2026-5026, -5942, -6088, -6089, -6090 High; -6091, -6218
Medium) are fixed since 1.26.6. The full list with links is in ENT-210.

## Changes

Same file set as #27157:

- `go.mod`: `go 1.26.5` to `go 1.26.9`
- `mise.toml` / `mise.lock`: Go toolchain pin and the archive URLs and
SHA-256 checksums for each platform (taken from the official `go.dev/dl`
release list)

## Verification

- `go build ./enterprise/cmd/coder` with go1.26.9 succeeds; `go mod tidy
-diff` is clean.
- `govulncheck -mode binary` on the resulting binary reports none of the
19 advisories above. The same scan of the released 2.38.0 binary
(go1.26.5) reports all 19.

## Not in this PR

`golang.org/x/net` v0.60.0 (the module-side half of GO-2026-6603, -6610,
-6611, -6612 and -6617) is already on `main` via #30772 and is
backported to the release branches in #30814 (2.38), #30815 (2.37),
#30816 (2.36), #30817 (2.35) and #30818 (2.34), tracked in
[ENT-211](https://linear.app/codercom/issue/ENT-211/ironbank-critical-bump-golangorgxnet-to-v0600-on-release-branches-fix).
The Go 1.27.1 bump (#30288) stays a separate, larger change. Go
backports: #30808 (2.38), #30809 (2.37), #30810 (2.36), #30813 (2.35),
#30811 (2.34).

Opened by Superblink on behalf of @droopy4096.