feat(xray): update xray-core to v26.11.9

Bump xtls/xray-core to 676eaf66f8f0 (v26.11.9) and the three binary pins
(DockerInit.sh, release.yml Linux + Windows) in lockstep, so the vendored
config loader and the child binary validate the same config.

The same go.mod also moves the go directive to 1.27.4 and
golang.org/x/crypto to v0.58.1-0.20261009181718-2f1f834330b2; the core pulls
in refraction-networking/utls 20261108164504, xtls/reality 20261108101329 and
klauspost/cpuid v2.4.2.

XDRIVE now caps concurrency at 256 instead of 64 (#7340), so the schema
comment quoting the cap follows.

.github/workflows/release.yml

@@ -115,7 +115,7 @@ jobs:
           cd x-ui/bin
 
           # Download dependencies
-          Xray_URL="https://github.com/XTLS/Xray-core/releases/download/v26.10.31/"
+          Xray_URL="https://github.com/XTLS/Xray-core/releases/download/v26.11.9/"
           if [ "${{ matrix.platform }}" == "amd64" ]; then
             fetch ${Xray_URL}Xray-linux-64.zip
             unzip Xray-linux-64.zip
@@ -283,7 +283,7 @@ jobs:
           cd x-ui\bin
 
           # Download Xray for Windows
-          $Xray_URL = "https://github.com/XTLS/Xray-core/releases/download/v26.10.31/"
+          $Xray_URL = "https://github.com/XTLS/Xray-core/releases/download/v26.11.9/"
           Invoke-WebRequest @retry -Uri "${Xray_URL}Xray-windows-64.zip" -OutFile "Xray-windows-64.zip"
           Expand-Archive -Path "Xray-windows-64.zip" -DestinationPath .
           Remove-Item "Xray-windows-64.zip"