[20.10 backport] Bump go 1.16.6

[thaJeztah]

opening as draft, as this is based on #42642. I'll rebase once that's merged done

backport of:

• Bump golang 1.16.5 #40353 Bump golang 1.16.5
• Bump go 1.16.6 (addresses CVE-2021-34558) #42631 Bump go 1.16.6 (addresses CVE-2021-34558)

[samuelkarp]

LGTM

[thomasgl-orange]

@thaJeztah : I just got beaten by upgrading to 20.10.8 on a server with an $HTTP_PROXY environment variable but no $HTTPS_PROXY. This used to work fine for accessing https://... images registries through the HTTP proxy, but does not work any more after this golang 1.16.x update; see golang/go#40909 and 1.16 release notes.
Maybe that's something which would be worth mentioning in the 20.10.8 release notes, because if it has happened to me a few hours after the release, I assume I won't be the only one.

[thaJeztah]

@thomasgl-orange ah, good call, yes. Are you interested in contributing a PR in the documentation repository? https://github.com/docker/docker.github.io/blob/master/engine/release-notes/index.md

(I'll amend the release notes in this repository as well after that)

[thaJeztah]

TBH, I'm still on the fence if golang/go#40909 was the right thing to do; I don't see a reason for doing that (other than some obscure use-case reported by the user), as using a HTTP_PROXY for https:// request (AFAIK) should be valid.

[thomasgl-orange]

Thanks for the quick reply.

Are you interested in contributing a PR in the documentation repository?

Would something like docker/docs#13284 be okay?

TBH, I'm still on the fence if golang/go#40909 was the right thing to do

I don't mind having to set a distinct proxy env var for https (curl does it too, it won't use $http_proxy for https, IIRC). But as a Java dev, I'm amazed that such changes in a standard lib can happen without a 10 years deprecation notice :-)

[thaJeztah]

Would something like docker/docs#13284 be okay?

Thank you! I'll review that one shortly

I'm amazed that such changes in a standard lib can happen without a 10 years deprecation notice :-)

Agreed. It's somewhat "unexpected".