Pin Go to the version each project declares in go.mod

setup_go with no GO_VERSION resolves to whatever go.dev currently serves, so
every Go app was built against a moving target. When 1.27 landed it broke
wanderer outright (#16909): PocketBase pins go 1.25.0 and stack-overflows at
startup when built with anything newer.

Two problems, both fixed here:

setup_go ran before the source was fetched in all 15 install scripts, so the
pin could not be read even if someone wanted one. It now runs after the fetch
and reads the version out of go.mod.

13 ct/ scripts rebuild with go during update. Eleven never called setup_go at
all and rebuilt with whatever the container happened to have; the other two
called it before the fetch. All 13 now use the same call as their installer,
verified identical string for string.

caddy is left alone: xcaddy fetches the Caddy source itself, so there is no
local go.mod to read, and it already pins deliberately. wanderer is in #16976.

ct/networkoptimizer.sh

@@ -39,6 +39,7 @@ function update_script() {
 
     create_backup /opt/networkoptimizer/networkoptimizer.env
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/networkoptimizer/src/uwnspeedtest/go.mod | awk '{print $2}')" setup_go
     restore_backup
 
     msg_info "Rebuilding NetworkOptimizer"