fix: pin tools to fixed versions and fix govulncheck errors (#2718)

Tests are currently failing at HEAD.

One reason is because our tests run all tools using `@latest` in
all_test.go. This makes our test suite fragile because any upstream
breaking change can cause failures without warning. Instead, pin each
tool to a specific version and update them intentionally on a regular
cadence. This will ensure more reproducible and predictable test
outcomes.

Another reason is because of errors detected by `govulncheck`, which are
fixed by upgrading to go1.25.3.

Author: julieqiu

all_test.go

@@ -160,11 +160,11 @@ func hasValidHeader(path string, r io.Reader) (bool, error) {
 }
 
 func TestGolangCILint(t *testing.T) {
-	rungo(t, "run", "github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest", "run")
+	rungo(t, "run", "github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0", "run")
 }
 
 func TestGoImports(t *testing.T) {
-	cmd := exec.Command("go", "run", "golang.org/x/tools/cmd/goimports@latest", "-d", ".")
+	cmd := exec.Command("go", "run", "golang.org/x/tools/cmd/goimports@v0.38.0", "-d", ".")
 	var out bytes.Buffer
 	cmd.Stdout = &out
 	cmd.Stderr = &out
@@ -182,7 +182,7 @@ func TestGoModTidy(t *testing.T) {
 }
 
 func TestGovulncheck(t *testing.T) {
-	rungo(t, "run", "golang.org/x/vuln/cmd/govulncheck@latest", "./...")
+	rungo(t, "run", "golang.org/x/vuln/cmd/govulncheck@v1.1.4", "./...")
 }
 
 func TestGodocLint(t *testing.T) {

go.mod

@@ -1,6 +1,6 @@
 module github.com/googleapis/librarian
 
-go 1.25.0
+go 1.25.3
 
 require (
 	cloud.google.com/go/artifactregistry v1.17.2

testdata/e2e-test.Dockerfile

@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # Start with a Go base image
-FROM golang:1.25.0 AS builder
+FROM golang:1.25.3 AS builder
 
 WORKDIR /app