Remediate reachable CVE by pinning golang.org/x/text to v0.3.8 and adding ParseLanguage regression coverage

[Copilot]

This PR addresses the reachable high-priority dependency finding on golang.org/x/text@v0.3.7 in the ParseLanguage request path. The vulnerable version is removed from the module graph and replaced with a fixed version while keeping route behavior intact.

• Dependency remediation

  • Bump golang.org/x/text from v0.3.7 to v0.3.8 in go.mod.
  • Regenerate go.sum so the resolved lock state no longer includes v0.3.7.

• Handler-path regression coverage (internal/handlers/cve_test.go)

  • Add focused tests for ParseLanguage:
    • allowlisted valid tag succeeds (en-US)
    • unsupported tag is rejected (zh)
    • malformed encoded tag is rejected (en%0AUS)

• Example of the added guard-path assertions

  req := httptest.NewRequest(http.MethodGet, "/parse-language?tag=en%0AUS", nil)
  rec := httptest.NewRecorder()
  
  ParseLanguage(rec, req)
  
  if rec.Code != http.StatusBadRequest {
      t.Fatalf("expected %d, got %d", http.StatusBadRequest, rec.Code)
  }