build(deps): maintain Go dependencies and migrate mapstructure v2

[DoDiODev]

Go dependency maintenance and mapstructure v2 — PR text

Summary

This PR performs a focused Go dependency maintenance update and replaces the
archived direct mitchellh/mapstructure import with the maintained
go-viper/mapstructure/v2 module. It contains no schema or migration-script
changes. A small DAL compatibility fix keeps PostgreSQL index drops working
with the updated GORM PostgreSQL driver; the affected SonarQube E2E test now
uses the same DAL abstraction. There are no API, CI, frontend, Docker-image,
or Go-toolchain changes.

Changes

Module	Before	After	Decision
golang.org/x/mod	v0.38.0	v0.40.0	Included; fixes GO-2026-6180 and GO-2026-6179 in the required module.
gorm.io/driver/postgres	v1.5.2	v1.6.2	Included together with the required GORM upgrade.
gorm.io/gorm	v1.25.5	v1.31.2	Included; validated through the normal Go build and unit-test paths.
github.com/coreos/go-oidc/v3	v3.9.0	v3.20.0	Included; the OIDC/authentication tests pass.
github.com/mitchellh/mapstructure	v1.5.0 direct	removed direct requirement	All eight Go imports now use the v2 module.
github.com/go-viper/mapstructure/v2	not direct	v2.5.0 direct	Added as the replacement module.
golang.org/x/sync	v0.22.0	unchanged	Already current on the PR base.

The mapstructure change is an import-path-only migration. Existing struct tags,
custom decode hooks, WeaklyTypedInput, and decoder configuration are retained.
The old mitchellh/mapstructure v1.4.1 entry that remains in go.mod is
transitive through github.com/spf13/viper; no application source imports it
any longer.

go mod tidy also records the expected transitive updates, including
golang.org/x/tools v0.49.0 and go-jose/v4 from the OIDC upgrade.

The fresh direct-module audit on 2026-08-19 also reported updates for
aws-sdk-go, cockroachdb/errors, gin, validator/v10, go-sql-driver/mysql,
google/uuid, ants/v2, cron/v3, cast, cobra, viper, swaggo, gjson,
viant/afs, gorm.io/datatypes, gorm.io/driver/mysql, and the previously
listed gocsv, properties, go-internal, testify, and x/exp. All are
explicitly deferred as independent review items; no unreviewed direct update
is bundled into this PR.

Direct-module decisions

The pre-branch direct build-graph audit reported additional updates. They are
intentionally not bundled without their own review:

• gocarina/gocsv: pseudo-version update deferred pending changelog/diff review.
• magiconair/properties: v1.8.5 → v1.18.11 is a large independent jump and
  should be handled separately.
• rogpeppe/go-internal: v1.14.1 → v1.16.0 deferred.
• stretchr/testify: v1.11.1 → v1.12.0 deferred.
• golang.org/x/exp: pseudo-version update deferred pending compatibility review.

The Go toolchain bootstrap and minimum patch level are deliberately outside this
change.

Validation

Completed successfully:

• go mod tidy
• go test ./helpers/oidchelper/... ./server/api/auth/...
• targeted unit tests for the mapstructure, helper, remote-scope, GitHub,
  Jira, Customize, Issue Trace, and Zentao packages
• go test ./impls/dalgorm ./plugins/sonarqube/e2e -run 'Test_validateQuery|TestSonarqubeIssueCodeBlockLongComponent' -count=1
• gofmt -d over all changed Go files
• make build (all plugins, mocks, Swagger generation, and the server)
• make unit-test-go
• MySQL and PostgreSQL make e2e-test runs against isolated local lake_test
  databases, both completed with exit code 0
• govulncheck -show verbose ./...: no vulnerabilities reachable from the
  DevLake code; three uncallable module-only findings have no fixed version
• CVE validation for x/mod v0.40.0, GORM v1.31.2, PostgreSQL driver v1.6.2,
  go-oidc v3.20.0, and mapstructure v2.5.0: no known CVEs reported

The PostgreSQL run initially exposed the updated driver's invalid
DROP INDEX CURRENT_SCHEMA()."…" SQL. The DAL now uses a PostgreSQL-specific
DROP INDEX IF EXISTS path, while retaining the existing GORM migrator path
for other dialects. The SonarQube migration E2E test passes on both the PR
branch and upstream/main's older dependency baseline.

Required pre-merge gates

• Run the MySQL and PostgreSQL E2E suites with their respective test
  databases.
• Create/edit at least one GitHub and one Jira connection through the UI to
  exercise connection and scope-config decoding with mapstructure v2.
• Verify invalid connection credentials still produce the expected API error.

Commit structure

1. build(deps): bump x/mod to v0.40.0
2. build(deps): update gorm postgres driver
3. build(deps): update go-oidc
4. refactor(deps): replace mapstructure with go-viper v2
5. fix(db): keep postgres index drops compatible with updated GORM

[klesh]

LGTM
Thank you for your contribution.