Bump supported Go version and add policy (#352)

Signed-off-by: Andrew Harding <azdagron@gmail.com>

Author: azdagron

Makefile

@@ -85,7 +85,7 @@ apiprotos := \
 # Toolchain
 #############################################################################
 
-go_version_full := 1.23.8
+go_version_full := 1.24.6
 go_version := $(go_version_full:.0=)
 go_dir := $(build_dir)/go/$(go_version)
 

README.md

@@ -44,3 +44,15 @@ streamed from the Workload API (e.g. secret rotation).
 ## Examples
 
 The [examples](./examples) directory contains rich examples for a variety of circumstances.
+
+## Supported Go Versions
+
+This library tracks the minimum officially supported Go version (i.e. N-1). The
+only exception to this policy will be in response to a security issue affecting
+a dependency that forces a premature upgrade. This action is expected to be rare, 
+will not be taken lightly, and not until reasonable efforts to mitigate the
+security issue while maintaining this policy are pursued.
+
+## Reporting Security Vulnerabilities
+
+If you've found a vulnerability or a potential vulnerability in go-spiffe, please let us know at <security@spiffe.io>. We'll send a confirmation email to acknowledge your report, and we'll send an additional email when we've identified the issue positively or negatively.

go.mod

@@ -1,6 +1,6 @@
 module github.com/spiffe/go-spiffe/v2
 
-go 1.23.0
+go 1.24.0
 
 require (
 	github.com/Microsoft/go-winio v0.6.2