Fix/20260506 update go mod cves

[raharper]

What type of PR is this?

bug

Which issue does this PR fix:

#742
#734
#732
#708
#704

What does this PR do / Why do we need it:

Address current dependabot/CVE issues.

If an issue # is not available please add repro steps and logs showing the issue:

Testing done on this change:

make test

Automation added to e2e:

Will this break upgrades or downgrades?

no

Does this PR introduce any user-facing change?:

no

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[raharper]

Looks like will need to dig into the containers/storage Differ issue:

      GetDiffer -> NewDiffer which breaks the storage_dest.go in
      the v5.34.0.  Note this is only detectable via `make lint` as
      the stacker binary does not utilize the pkg/lib code; but we have
      downstream tools which do import this which may be affected.

[raharper]

Looks like will need to dig into the containers/storage Differ issue:

      GetDiffer -> NewDiffer which breaks the storage_dest.go in
      the v5.34.0.  Note this is only detectable via `make lint` as
      the stacker binary does not utilize the pkg/lib code; but we have
      downstream tools which do import this which may be affected.

If we try to keep the older securejoin, go mod tidy complains with

$ go mod tidy
go: downloading github.com/cyphar/filepath-securejoin v0.4.1
go: finding module for package github.com/cyphar/filepath-securejoin/pathrs-lite/procfs
go: finding module for package github.com/cyphar/filepath-securejoin/pathrs-lite
go: stackerbuild.io/stacker/pkg/lib/containers_storage imports
	github.com/containers/image/v5/storage imports
	github.com/containers/storage imports
	github.com/opencontainers/selinux/go-selinux imports
	github.com/cyphar/filepath-securejoin/pathrs-lite: module github.com/cyphar/filepath-securejoin@latest found (v0.6.1, replaced by github.com/cyphar/filepath-securejoin@v0.4.1), but does not contain package github.com/cyphar/filepath-securejoin/pathrs-lite
go: stackerbuild.io/stacker/pkg/lib/containers_storage imports
	github.com/containers/image/v5/storage imports
	github.com/containers/storage imports
	github.com/opencontainers/selinux/go-selinux imports
	github.com/cyphar/filepath-securejoin/pathrs-lite/procfs: module github.com/cyphar/filepath-securejoin@latest found (v0.6.1, replaced by github.com/cyphar/filepath-securejoin@v0.4.1), but does not contain package github.com/cyphar/filepath-securejoin/pathrs-lite/procfs

and using 0.6.1

golangci-lint run --build-tags "exclude_graphdriver_btrfs exclude_graphdriver_devicemapper containers_image_openpgp osusergo netgo skipembed"
pkg/lib/containers_storage/lib.go:8:2: could not import github.com/containers/image/v5/storage (.build/gopath/pkg/mod/github.com/containers/image/v5@v5.34.3/storage/storage_dest.go:32:2: could not import github.com/containers/storage (-: # github.com/containers/storage
.build/gopath/pkg/mod/github.com/containers/storage@v1.58.0/userns.go:334:29: undefined: securejoin.OpenInRoot
.build/gopath/pkg/mod/github.com/containers/storage@v1.58.0/userns.go:340:20: undefined: securejoin.Reopen)) (typecheck)
	"github.com/containers/image/v5/storage"
	^
1 issues:
* typecheck: 1

[raharper]

Closing in favor of #764