fix(release): backport fixes for v1.4.2

[sozercan]

Summary

Backport all product fixes merged to main after the v1.4.1 release:

• fix: use --pkg-types instead of deprecated --vuln-type for trivy #1223: replace Trivy's deprecated --vuln-type flag with --pkg-types
• fix(deps): remediate Go module vulnerabilities #1224: remediate Go module vulnerabilities, upgrade the toolchain and Trivy, remove the Trivy Go-library dependency, migrate test helpers to ORAS v2, and stabilize pull-secret E2E checks

The automated v1.4.1 documentation patch (#1194) is intentionally excluded because it is not a product fix and targets main-only versioned docs.

Release considerations

• Raises the minimum Go/tooling version from 1.24 to 1.26.
• Preserves the release branch's v1.4.1 version metadata; the separate v1.4.2 release-preparation PR should update it after this backport merges.
• Includes the associated workflow, generated CRD/RBAC, lint, and test changes required by the dependency/tooling upgrade.

Validation

• go mod verify
• go test ./pkg/scanners/trivy ./test/e2e/util
• actionlint -shellcheck= -pyflakes=
• git diff --check origin/release-1.4...HEAD
• Confirmed the backported tree matches the expected conflict-free application and preserves only the intended v1.4.x release metadata differences

A full Linux compile/vet was attempted locally but the host exhausted temporary disk space; GitHub's PR test and E2E workflows will provide the authoritative full validation.