Set minimal Go toolchain version

Right now the binaries (e.g. for the 5.8.1) release are built using the default Go version that is available on GitHub runners. For that release it meant 1.24.0. This means that when the binary is scanned for instance with trivy it will show tons of relevant CVEs due to that old Go version. My proposal would be to set a `toolchain` directive inside the `go.work` file to enforce a minimum version number for the build process. This version would be kept up-to-date by dependabot. WDYT?