Bump Go toolchain to 1.27.2 and x/crypto to v0.58.0

Clears 9 reachable stdlib govulncheck findings (all fixed in go1.27.2).
Remaining: GO-2026-5932 (x/crypto/openpgp, module-level only, no fix
available; our code does not call it).

go.mod

@@ -1,11 +1,11 @@
 module palette
 
-go 1.27.1
+go 1.27.2
 
 require (
 	github.com/go-chi/chi/v5 v5.3.2
 	github.com/go-enry/go-enry/v2 v2.9.6
-	golang.org/x/crypto v0.39.0
+	golang.org/x/crypto v0.58.0
 	modernc.org/sqlite v1.58.0
 )
 
@@ -16,7 +16,7 @@ require (
 	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.49.0 // indirect
 	modernc.org/libc v1.75.6 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.12.1 // indirect