deps: update slack-go/slack from v0.18.0 to v0.27.0 (and other outdated dependencies)

Summary

The slack-go/slack dependency is 9 minor versions behind the latest release:

	Version
Current	v0.18.0
Latest	v0.27.0

This is the project's primary integration library — every Slack API call, event parse, and signature verification flows through it. Being this far behind means missing bug fixes, new API capabilities, and potential security patches.

Outdated Dependencies (full list)

Direct dependencies with available updates:

Module	Current	Available
github.com/slack-go/slack	v0.18.0	v0.27.0
github.com/rs/zerolog	v1.34.0	v1.35.1
github.com/go-sql-driver/mysql	v1.9.3	v1.10.0

Notable indirect dependencies:

Module	Current	Available
github.com/mattn/go-sqlite3	v1.14.22	v1.14.47
golang.org/x/sys	v0.41.0	v0.47.0
golang.org/x/text	v0.34.0	v0.40.0
golang.org/x/sync	v0.19.0	v0.22.0
golang.org/x/mod	v0.32.0	v0.38.0
golang.org/x/tools	v0.41.0	v0.48.0

Approach

1. Start with the indirect/low-risk dependencies (zerolog, go-sql-driver/mysql, golang.org/x/*)
2. Tackle slack-go/slack separately — a 9-version jump may include breaking changes that affect:
   • slackevents.ParseEvent (used in core/core.go:365)
   • slack.SlashCommandParse (used in core/core.go:469)
   • slack.NewSecretsVerifier (used in core/core.go:128)
   • slack.Client methods (used throughout plugins)
3. Run the full test suite after each update
4. Check for any nolint directives that may have been working around issues fixed upstream

Why This Matters

Staying this far behind on a core integration library increases technical debt, risks missing security fixes, and makes future updates harder (more changes to reconcile at once). The slack-go/slack library is particularly important as it mediates all Slack API interactions.

Related

• Issue #133 — plugin OAuth scope declaration (depends on understanding current slack-go capabilities)
• Dependabot is currently disabled for this repo (separate issue to address)