acme package gets standards-compliant order finalization

An accepted proposal reworks x/crypto/acme's Client.CreateOrderCert to follow the ACME spec properly for order finalization, tidying up a long-standing quirk in how the finalization URL is handled. Alongside it, a post on Go's garbage collector under load walks through what actually happens when the runtime starts sweating, and a Crossplane advisory covers a signature-verification TOCTOU that lets unverified package content slip through in crossplane-runtime v2.