GeezerVison

Mitigates CVE-2026-111943 (compromised eMudhra intermediate CAs).

- Go 1.26.9 -> 1.26.10, which no longer trusts the compromised
  intermediates.
- Bundled Terraform 1.14.5 (1.15.5 in the image) -> 1.16.7, which is built with Go 1.26.10.
  Older Terraform minor lines did not receive this fix.
- Base image alpine 3.24.1 -> 3.24.3 so it ships ca-certificates-bundle
  20261020-r0.

…est certificate (#30922)

Renews the SMTP test server certificate in
`coderd/notifications/dispatch/smtptest/fixtures`. It expired on
2026-10-18 at 13:36:08Z, so the TLS cases of `TestSMTP`
(`TLS:_self-signed`, `TLS:_self-signed_+_SNI`, `PLAIN_auth_and_TLS`)
fail in `test-go-pg-17` and `test-go-race-pg` on every PR.

## What changed

- `server.crt`: the committed `server.csr`, re-signed with the committed
CA (`ca.crt`, `ca.key`) and `v3_ext.conf`. It is valid until 2034-07-12,
a day before the CA expires. The key pair, subject, and extensions (SANs
`myserver.local`, `www.myserver.local`, `127.0.0.1`) are unchanged. Only
the serial, the validity, and the signature differ.
- `ca.srl`: the next serial, which the new certificate uses.
- `generate.sh`: it issued the server certificate for 825 days, and
2024-07-15 plus 825 days is 2026-10-18. It now uses 3649 days, a day
less than the CA's 3650.

The command, run in the fixtures directory:

```sh
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -set_serial 0x0330C6D190E3FE649DAFCDA2F4D765E2D29328DF -out server.crt -days 2824 -extfile v3_ext.conf
```

With OpenSSL 3.0.2, `-CAserial ca.srl` issued a random serial and left
`ca.srl` unchanged, so the command sets the next serial explicitly.

## Review focus

Re-signing keeps the CA and the server key, so no other fixture or test
changes. The one choice is the validity: about 7.7 years, ending a day
before the CA.

## Validation

| Check | `main` | This PR |
|---|---|---|
| `openssl x509 -noout -dates` | `notAfter=Oct 18 13:36:08 2026 GMT` |
`notAfter=Jul 12 14:24:37 2034 GMT` |
| `openssl verify -CAfile ca.crt server.crt` | `certificate has expired`
| `server.crt: OK` |
| `go test ./coderd/notifications/dispatch/... -run TestSMTP -count=1` |
the 3 TLS cases fail with `x509: certificate has expired or is not yet
valid` | pass |

`go test ./coderd/notifications/... -count=1` passes, including
`notifications_test.go`, the other user of `smtptest`. A text diff of
the old and new certificates (`openssl x509 -noout -text`) shows only
the serial, the dates, and the signature.

> Xum, an AI agent, opened this PR for @ibetitsmike and wrote this
description.

(cherry picked from commit 1213938)

cjfit left a comment