main: Use latest Go 1.25 features if possible.

In order to avoid breaking backwards compatibility, newer versions of Go
toolchains automatically set GODEBUG flags to disable any changes that
are not strictly backwards compatible when compiling old code.  However,
it is often the case that older code will work properly with the new
features and security updates enabled and those updates are generally
desirable.

The existing code in the main module will all work properly with all
changes in Go 1.25, so this adds a directive when building with Go 1.25
or newer to override and remove the default GODEBUG flags which disable
newer features and security updates that are not strictly backwards
compatible.  In other words, it ensures the new features and security
updates implemented in Go 1.25 are enabled when building with Go 1.25 or
newer.

The specific GODEBUG flags removed are:

- `asynctimerchan=1`
- `containermaxprocs=0`
- `decoratemappings=0`
- `gotestjsonbuildtext=1`
- `gotypesalias=0`
- `httplaxcontentlength=1`
- `httpmuxgo121=1`
- `httpservecontentkeepheaders=1`
- `multipathtcp=0`
- `panicnil=1`
- `randseednop=0`
- `rsa1024min=0`
- `tls10server=1`
- `tls3des=1`
- `tlsmlkem=0`
- `tlsrsakex=1`
- `tlssha1=1`
- `tlsunsafeekm=1`
- `updatemaxprocs=0`
- `winreadlinkvolume=0`
- `winsymlink=0`
- `x509keypairleaf=0`
- `x509negativeserial=1`
- `x509rsacrt=0`
- `x509sha256skid=0`
- `x509usepolicies=0`

The only notable change that could potential affect existing deployments
is that it is no longer possible to use certificates that use RSA keys
with less than 1024-bit keys.  This is very unlikely to affect anyone in
practice because the default generated certificates use ECC and there is
not even an option to generate RSA certificates with dcrd itself.
Further, the separate gencerts utility does support generating RSA
certs, but those use 4096-bit RSA keys.  In other words, a user would
have needed to generate such a certificate with external tools, such as
openssl, which would require them to know exactly what they're doing and
so it would be easy for them to generate new certs if the change were to
actually affect them.

Author: davecgh

debug.go

@@ -0,0 +1,25 @@
+// Copyright (c) 2025 The Decred developers
+// Use of this source code is governed by an ISC
+// license that can be found in the LICENSE file.
+
+// This file changes the default GODEBUG values when building with newer
+// releases of Go to enable as many of the new features and security updates
+// that are not strictly backwards compatible as possible.
+//
+// For reference, in order to avoid breaking backwards compatibility, newer
+// versions of Go toolchains automatically set GODEBUG flags to disable any
+// changes that are not strictly backwards compatible when compiling old code.
+// However, it is often the case that older code will work properly with the
+// new features and security updates enabled and those updates are generally
+// desirable.
+//
+// WARNING: Do not blindly update this with each new Go release.  It needs to
+// be analyzed with each new release before updating to ensure none of the
+// changes in the newer versions of Go that are disabled by default due to not
+// being strictly backwards compatible will break the existing code.
+
+//go:build go1.25
+
+//go:debug default=go1.25
+
+package main