the package [points](https://github.com/bottlerocket-os/bottlerocket-core-kit/blob/4c950e56fb81aad948cf7db539fc9ddbb5ca330e/packages/amazon-vpc-cni-plugins/Cargo.toml#L13) to a git submodule and that submodule points to a 2yr old version of the `vpc-cni-plugin`. This is triggering several security scanners of dependencies using EOL SDK versions.