chore: update Go to v1.27 (#39068)

Only made some necessary changes:

1. remove `GOEXPERIMENT`, only use jsonv2
1. `make fmt`
* `SigningKey` and `Signature` were affected due to some bugs in the
toolchain, so rewrote them
1. remove or fix fragile magic numbers and strings
    * the outputs of image/gzip/zlib packages are different
1. update "nolint" comments for the changed lint behaviors
1. add `tls.MLKEM1024`

modules/avatar/hash.go

@@ -9,20 +9,12 @@ import (
 	"strconv"
 )
 
-// HashAvatar will generate a unique string, which ensures that when there's a
-// different unique ID while the data is the same, it will generate a different
-// output. It will generate the output according to:
-// HEX(HASH(uniqueID || - || data))
-// The hash being used is SHA256.
-// The sole purpose of the unique ID is to generate a distinct hash Such that
-// two unique IDs with the same data will have a different hash output.
-// The "-" byte is important to ensure that data cannot be modified such that
-// the first byte is a number, which could lead to a "collision" with the hash
-// of another unique ID.
+// HashAvatar generates a unique string for input ID and data.
+// Because avatar is per-user, one user deletes their avatar should not affect another user who uses the same avatar.
 func HashAvatar(uniqueID int64, data []byte) string {
 	h := sha256.New()
 	h.Write([]byte(strconv.FormatInt(uniqueID, 10)))
-	h.Write([]byte{'-'})
+	h.Write([]byte{'-'}) // make sure the bytes in data won't conflict with ID
 	h.Write(data)
 	return hex.EncodeToString(h.Sum(nil))
 }