Fix broken golangci-lint installation in go feature

[max06]

Currently using the go-feature in devcontainers without specifying an older version to install breaks building devcontainers.

After investigating, 2 reasons were identified for breaking:

• golangci-lint now releases sbom-files with their binary releases. The install-script now finds 2 hashes matching the filename, which was corrected by the maintainers yesterday (and released today, 3 hours ago in fix: install.sh script golangci/golangci-lint#6539).
• The golangci-lint project switched their primary branch from master to main, date irrelevant. Their fix for the first issue was properly merged into main, but the installation script for this container-feature was never updated, still pointing to master - missing the fix.

This should be merged quickly.

Potential workaround: Using v2.11.4 as version for golangci-lint should work since sbom-files were added in v2.12 for the first time.

[ldez]

We (golangci-lint maintainers) recommend using https://golangci-lint.run/install.sh instead of an URL based of a branch.

https://golangci-lint.run/docs/welcome/install/local/#binaries

This is for several reasons:

• GitHub applies new rate limits
• Referencing a branch can be brittle

[rjchien728]

Confirming this hits us on linux/arm64 via ghcr.io/devcontainers/features/go with golangciLintVersion: latest (resolves to v2.12.1). Same hash_sha256_verify failure caused by the SBOM line in checksums.txt being matched alongside the tarball.
I tested the workaround curl -sSfL https://golangci-lint.run/install.sh | sh directly in our devcontainer — it works and produces the correct binary. So this PR's approach LGTM from a downstream user's perspective.

[alperyazar]

I can confirm that fixing linter to older version fixes the problem until this PR is merged.

{
  "features": {
    "ghcr.io/devcontainers/features/go:1": {
      "golangciLintVersion": "2.11.4"
    }
  }
}

[max06]

@bamurtaugh Good morning and sorry for the ping - could you please try to speed this up a bit? It shouldn't take days to merge a simple fix.