file: ensure parent directory exists in Save; bump Go to 1.26 and CI actions

[unknwon]

Summary

Three changes bundled per request:

1. Bug fix: fileStore.Save fails when parent directory does not exist

fileStore.Save writes the session file directly with os.WriteFile, but the two-level parent directory (<root>/<sid[0]>/<sid[1]>/) is only created lazily inside Read. When Save is called for a session ID whose parent directory does not yet exist, it fails with:

open <root>/i/3/i3qn0rl89bvr19oi: no such file or directory

This is reachable via the documented RegenerateID flow: after login, applications commonly regenerate the session ID to defend against session fixation. BaseSession.RegenerateID mints a fresh SID and mutates s.sid in place without touching the store, so the next Save writes to a path whose parent directory was never created.

Fix: call os.MkdirAll(filepath.Dir(filename), 0700) before os.WriteFile in fileStore.Save, mirroring the same pattern already present in Read (file.go:71). Mode 0700 matches Read and the 0600 files it contains.

2. Chore: bump Go to 1.26 and CI actions to latest

• go.mod: go 1.25.0 → go 1.26.0
• workflow matrix: 1.24.x → 1.26.x
• actions/checkout@v4 → v6
• actions/setup-go@v5 → v6
• golangci/golangci-lint-action@v7 → v9

3. Bump modernc.org/sqlite to v1.51.0

Under Go 1.26, TestSQLiteStore panics with SQLITE_BUSY on v1.50.0. v1.51.0 resolves it cleanly.

Test plan

• go test ./... passes for github.com/flamego/session on Go 1.26
• go test ./sqlite passes on Go 1.26 with modernc.org/sqlite v1.51.0
• Verified fileStore.Save fix resolves the open ... no such file or directory error in a downstream app that calls RegenerateID after login
• CI to confirm Mongo / MySQL / Postgres / Redis suites still pass under Go 1.26 (cannot validate locally)