Update to oauth2 0.28 (addresses GO-2025-3488)

The previous version contained a vunerability that allows an attacker
to pass a malicious/malformed token which causes unexpected memory to
be consumed during parsing.

Author: dirkmueller

go.mod

@@ -13,7 +13,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0
 	github.com/spf13/cobra v1.8.1
-	golang.org/x/oauth2 v0.25.0
+	golang.org/x/oauth2 v0.28.0
 	golang.org/x/sync v0.10.0
 	golang.org/x/tools v0.29.0
 )