security/keyward: Build with Go 1.26

The port's go.mod requires go 1.26.4, but USES=go:modules selects
GO_DEFAULT (1.25). The build still succeeded, because during the fetch
phase GOPROXY is live and go125 satisfies the directive by downloading
an entire go1.26.4 toolchain into the module cache; the build phase then
finds it there and switches to it despite GOPROXY=off.

So the port declared a build dependency on lang/go125 while actually
compiling with an undeclared, unchecksummed toolchain pulled from
proxy.golang.org. Depend on lang/go126 instead.