🌱 Bump the docker-images group across 1 directory with 2 updates (#1682)

Bumps the docker-images group with 2 updates in the / directory: golang and distroless/base.


Updates `golang` from 1.26.4 to 1.26.5

Updates `distroless/base` from `57c1e4c` to `f4a335c`

---
updated-dependencies:
- dependency-name: distroless/base
  dependency-version: 7c4468db5fea18a1630860619be640c4c0ad158c0d63f12951b96b7d0f5ddd62
  dependency-type: direct:production
  dependency-group: docker-images
- dependency-name: golang
  dependency-version: 1.26.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: docker-images
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

Dockerfile

@@ -22,7 +22,7 @@
 #           -e GITHUB_REPOSITORY="ossf/scorecard" \
 #           laurentsimon/scorecard-action:latest
 
-FROM golang:1.26.4@sha256:87a41d2539e5671777734e91f467499ed5eafb1fb1f77221dff2744db7a51775 AS builder
+FROM golang:1.26.5@sha256:3aff6657219a4d9c14e27fb1d8976c49c29fddb70ba835014f477e1c70636647 AS builder
 WORKDIR /src
 ENV CGO_ENABLED=0
 COPY go.* ./
@@ -35,7 +35,7 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 make build
 
 # Need root for GitHub Actions support
-FROM gcr.io/distroless/base@sha256:57c1e4c72feb5925c4763ae4f6bd2013ad3854f57eff5b60dd9acb1ce0abc66e
+FROM gcr.io/distroless/base@sha256:f4a335ca209e1d2ee873102c17c389ad0142e3d5b21aee2817e9cc9c01d87d20
 COPY --from=build /src/scorecard-action /
 COPY policies/template.yml /policy.yml
 ENTRYPOINT [ "/scorecard-action" ]