x/net/html security fix pre-announced for October 27

The Go security team has pre-announced a golang.org/x/net/html fix landing during US business hours on Tuesday October 27, covering multiple CVEs, so anyone pulling that module into a server has a calendar entry to make. Elsewhere, there is a proposal to let os/exec install seccomp-bpf filters between fork and execve on Linux, which pairs nicely with the week's sandboxing mood, and a smaller one from mvdan to add io/fs.ErrNotDir for code probing candidate directories.