Bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 (#929)

Trivy fails on every fresh CI run since CVE-2026-56852 (infinite loop
on invalid input in golang.org/x/text, fixed in v0.39.0) was published
against the v0.38.0 pinned in go.mod. Bumps x/text and its transitive
x/mod and x/tools updates.