cmd/go: malicious GOMODPROXY can cause golang.org/toolchain checksum bypass

If a user is operating inside of a malicious Go project defining its own go.sum with a bogus entry for the golang.org/toolchain, a malicious GOMODPROXY can coordinate and serve an arbitrary golang.org/toolchain, bypassing the intended checksum.

---

This is CVE-2026-94447, originally tracked in http://b/547888895.