Remediate reachable golang.org/x/text DoS finding with minimal version bump

[Copilot]

Reachable identified a production path through internal/handlers/cve.go that uses vulnerable golang.org/x/text v0.3.7. This change updates only that dependency to the first fixed release and locks in the existing route guard with focused coverage.

• Dependency remediation

  • Bump golang.org/x/text from v0.3.7 to v0.3.8
  • Refresh go.sum to the resolved fixed checksums only

• Reachable path preservation

  • Keep the existing ParseLanguage allowlist gate in front of language.Parse
  • Avoid widening scope beyond the selected remediation shard

• Regression coverage

  • Add focused handler tests for:
    • accepted allowed tags
    • rejected unsupported tags

if !safety.AllowedLanguageTag(tag) {
	http.Error(w, "unsupported language tag", http.StatusBadRequest)
	return
}

parsed, err := language.Parse(tag)