chore(lint): bump golangci-lint to v2.11.1 (#7905)

- Added nolint to plugin/auto/walk.go to avoid a symlink/TOCTOU
  warning, as it needs to follow symlink.
- Replaced a few flagged integer conversions with safe equivalents in
  cache hashing, reuseport socket setup, and TLS arg handling
- Preallocated response rule slices in plugin/rewrite/name.go
- Replaced WriteString(fmt.Sprintf/Sprintln(...)) with direct
  fmt.Fprint* calls
- Removed stale nolint directives from code and tests that are no
  longer needed

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

core/dnsserver/onstartup.go

@@ -35,23 +35,23 @@ func startUpZones(protocol, addr string, zones map[string][]*Config) string {
 	var sb strings.Builder
 	for _, zone := range keys {
 		if !checkZoneSyntax(zone) {
-			sb.WriteString(fmt.Sprintf("Warning: Domain %q does not follow RFC1035 preferred syntax\n", zone))
+			fmt.Fprintf(&sb, "Warning: Domain %q does not follow RFC1035 preferred syntax\n", zone)
 		}
 		// split addr into protocol, IP and Port
 		_, ip, port, err := SplitProtocolHostPort(addr)
 
 		if err != nil {
 			// this should not happen, but we need to take care of it anyway
-			sb.WriteString(fmt.Sprintln(protocol + zone + ":" + addr))
+			fmt.Fprintln(&sb, protocol+zone+":"+addr)
 			continue
 		}
 		if ip == "" {
-			sb.WriteString(fmt.Sprintln(protocol + zone + ":" + port))
+			fmt.Fprintln(&sb, protocol+zone+":"+port)
 			continue
 		}
 		// if the server is listening on a specific address let's make it visible in the log,
 		// so one can differentiate between all active listeners
-		sb.WriteString(fmt.Sprintln(protocol + zone + ":" + port + " on " + ip))
+		fmt.Fprintln(&sb, protocol+zone+":"+port+" on "+ip)
 	}
 	return sb.String()
 }

core/dnsserver/server_quic.go

@@ -368,7 +368,6 @@ func readDOQMessage(r io.Reader) ([]byte, error) {
 	// A client or server receives a STREAM FIN before receiving all the bytes
 	// for a message indicated in the 2-octet length field.
 	// See https://www.rfc-editor.org/rfc/rfc9250#section-4.3.3-2.2
-	//nolint:gosec
 	if size != uint16(len(buf)) { // #nosec G115 -- buf length fits in uint16
 		return nil, fmt.Errorf("message size does not match 2-byte prefix")
 	}