update: bump the gomod-packages group with 2 updates

[dependabot]

Bumps the gomod-packages group with 2 updates: github.com/docker/cli and github.com/sigstore/cosign/v2.

Updates github.com/docker/cli from 29.6.1+incompatible to 29.6.2+incompatible

Commits

• dfc4efb Merge pull request #7109 from vvoland/update-docker
• dba8675 Bump to 29.6.2
• d9aefe5 Merge tag 'v29.6.1' into 29.x
• 9182b35 Merge tag 'v29.6.0' into 29.x
• 0ae55a3 Merge tag 'v29.5.3' into 29.x
• 029a4b2 Merge tag 'v29.5.2' into 29.x
• e596fea Merge tag 'v29.5.1' into 29.x
• 0c72f45 Merge tag 'v29.5.0' into 29.x
• 26f2736 Merge tag 'v29.4.1' into 29.x
• ac4c4df Merge tag 'v29.4.0' into 29.x
• Additional commits viewable in compare view

Updates github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4

Release notes

Sourced from github.com/sigstore/cosign/v2's releases.

v2.6.4

This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using a mix of old Cosign signatures with the more recent bundle format.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Changelog

• 26261f05411d5552949ee1d97df1f8e55ec0e13d Allow attestation download to handle both bundle types (#4996) (#5017)
• d49a0c151125448fc247bb8c367518f46e1c0487 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick PR-4997 to release-2.6) (#5002)

Thanks to all contributors!

Commits

• 26261f0 Allow attestation download to handle both bundle types (#4996) (#5017)
• d49a0c1 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.