chore(deps): update non-major github actions

[renovate-coveooss]

This PR contains the following updates:

Package	Type	Update	Change
actions/setup-go	action	minor	v3.5.0 -> v3.6.1
step-security/harden-runner	action	minor	v2.11.1 -> v2.12.1

[skip release]

---

Release Notes

actions/setup-go (actions/setup-go)

v3.6.1

Compare Source

What's Changed

• Add workflow file for publishing releases to immutable action package by @​aparnajyothi-y in https://github.com/actions/setup-go/pull/584

Full Changelog: actions/setup-go@v3...v3.6.1

v3.6.0

Compare Source

What's Changed

• Upgrade @actions/cache by @​priyagupta108 in https://github.com/actions/setup-go/pull/579.
  In scope of this release we updated actions/cache package to 4.0.3. This update ensures continued support and compatibility, as older versions of the package are now deprecated. For more information please refer to the toolkit/cache.

Full Changelog: actions/setup-go@v3...v3.6.0

step-security/harden-runner (step-security/harden-runner)

v2.12.1

Compare Source

What's Changed

• Detection capabilities have been upgraded to better recognize attempts at runner tampering. These improvements are informed by real-world incident learnings, including analysis of anomalous behaviors observed in the tj-actions and reviewdog supply chain attack.
• Resolved an issue where the block policy was not enforced correctly when the GitHub Actions job was running inside a container on a self-hosted VM runner.

Full Changelog: step-security/harden-runner@v2...v2.12.1

v2.12.0

Compare Source

What's Changed

1. A new option, disable-sudo-and-containers, is now available to replace the disable-sudo policy, addressing Docker-based privilege escalation (CVE-2025-32955). More details can be found in this blog post.

2. New detections have been added based on insights from the tj-actions and reviewdog actions incidents.

Full Changelog: step-security/harden-runner@v2...v2.12.0

---

Configuration

📅 Schedule: Branch creation - "before 4:00am on Tuesday" in timezone America/Toronto, Automerge - "after 9:00am and before 12:00pm on tuesday, wednesday, thursday" in timezone America/Toronto.

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.