ci: give the Proton Drive race suite room on a slow runner and pin its tools

The race suite ran under Go's default 10 minute limit, which a slow
runner would hit; it now has 40 minutes in a 60 minute job. Go is the
1.27 line the code was verified with, not go.mod's minimum, so
govulncheck checks a patched standard library, and govulncheck is
pinned to v1.9.0 so a new release can't break the build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -13,8 +13,9 @@ env:
 jobs:
   protondrive:
     runs-on: ubuntu-latest
-    # The race suite takes about 6 minutes on a fast machine.
-    timeout-minutes: 45
+    # The race suite takes about 6 minutes on a fast machine and 7 on
+    # two cores; the slow runner may take several times that.
+    timeout-minutes: 60
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -22,7 +23,9 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@v5
         with:
-          go-version-file: go.mod
+          # The line the code was verified with, not go.mod's minimum,
+          # so govulncheck sees a patched standard library.
+          go-version: '1.27.x'
           # Caches the module and build caches, keyed on go.sum.
           cache: true
 
@@ -39,7 +42,9 @@ jobs:
           args: ./backend/protondrive/...
 
       - name: Test
-        run: go test -race ./backend/protondrive/...
+        # Go's default 10 minute limit per test binary is too short
+        # for the race suite on a slow runner.
+        run: go test -race -timeout 40m ./backend/protondrive/...
 
       - name: Fuzz
         run: |
@@ -48,4 +53,4 @@ jobs:
           done
 
       - name: Vulnerability check
-        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./backend/protondrive/...
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./backend/protondrive/...