cmd/go: toolchain directive can point to file relative to go.mod with ADS on windows

[rolandshoemaker]

Due to #71469, a toolchain directive with a ADS suffix (e.g. toolchain go1.25-:alt), can result in the toolchain attempting to execute a files alternate data stream that is located alongside the go.mod file.

Since it's somewhat complex to create a file with ADS, and as far as we could tell no source control software supports it, while clearly unexpected, we do not consider this significantly dangerous.

This is a PUBLIC track security issue per our security policy.

Thanks to Juho Forsén for reporting this issue.