CVE-2026-77405: amqp091-go TLS Version Downgrade via Missing MinVersion

// Vulnerable code in uri.go (< 1.13.0)
// tlsConfigFromURI builds tls.Config without pinning MinVersion.
// An attacker performing a TLS downgrade attack intercepts the handshake
// and forces the client to accept TLS 1.0 when built with Go < 1.18.

cfg := &tls.Config{
    ServerName: host,
    // MinVersion not set; defaults to 0 (runtime-chosen)
    // On Go < 1.18 this allows TLS 1.0 / 1.1
}

// Attack: connect a rogue broker that advertises only TLS 1.0.
// Client dials: amqps://user:pass@attacker-broker:5671/
// Handshake completes at TLS 1.0 -> BEAST/POODLE apply.
// Credentials and AMQP frames are now decryptable in transit.

// Fix applied in commit c9fd433 (PR #355):
cfg := &tls.Config{
    ServerName: host,
    MinVersion: tls.VersionTLS12, // explicit floor added by patch
}