ci: bump golangci lint (cherry-pick #25513 to version-2026.5)

go.mod

@@ -1,6 +1,6 @@
 module goauthentik.io
 
-go 1.26.0
+go 1.27.0
 
 require (
 	beryju.io/ldap v0.2.1

internal/outpost/proxyv2/application/mode_proxy.go

@@ -29,6 +29,8 @@ func (a *Application) configureProxy() error {
 	}
 	rsp := sentry.StartSpan(context.TODO(), "authentik.outposts.proxy.application_transport")
 	rp := &httputil.ReverseProxy{
+		// This code is deprecated/replaced on main anyways, so this is fine
+		//nolint:staticcheck
 		Director:       a.proxyModifyRequest(u),
 		Transport:      web.NewTracingTransport(rsp.Context(), a.getUpstreamTransport()),
 		ErrorHandler:   a.newProxyErrorHandler(),

internal/utils/tls.go

@@ -7,16 +7,15 @@ import (
 
 func GetTLSConfig() *tls.Config {
 	// Based on
-	// https://ssl-config.mozilla.org/#server=go&version=1.25&config=intermediate&guideline=5.7
+	// https://configurator.tlsref.org/#server=go&version=1.27&config=intermediate&hsts&guideline=6.0
 	tlsConfig := &tls.Config{
 		MinVersion: tls.VersionTLS12,
 		CurvePreferences: []tls.CurveID{
 			tls.X25519,
 			tls.CurveP256,
 			tls.CurveP384,
 		},
-		PreferServerCipherSuites: true,
-		CipherSuites:             []uint16{},
+		CipherSuites: []uint16{},
 	}
 
 	excludedCiphers := []uint16{

internal/web/proxy.go

@@ -76,6 +76,8 @@ func (ws *WebServer) configureProxy() {
 		ws.log.WithField("url", req.URL.String()).WithField("headers", req.Header).Trace("tracing request to backend")
 	}
 	rp := &httputil.ReverseProxy{
+		// This code is deprecated/replaced on main anyways, so this is fine
+		//nolint:staticcheck
 		Director:  director,
 		Transport: ws.upstreamHttpClient().Transport,
 	}

locale/en/dictionaries/golang.txt

@@ -18,3 +18,4 @@ gorm
 gorm
 gorm*
 logger
+nolint