fix(deps): resolve High OPA CVE

[brandtkeller]

Description

See CVE details below

Removed the direct use of OPA

Determined the cosign package as the source of the indirect import -> Bumped cosign to v2.5.0

This resulted in an error with the go mod:

go: github.com/zarf-dev/zarf/src/internal/packager/images imports
        github.com/docker/cli/cli/command imports
        go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc imports
        google.golang.org/grpc imports
        google.golang.org/grpc/balancer/pickfirst imports
        google.golang.org/grpc/balancer/pickfirst/pickfirstleaf tested by
        google.golang.org/grpc/balancer/pickfirst/pickfirstleaf.test imports
        google.golang.org/grpc/stats/opentelemetry: ambiguous import: found package google.golang.org/grpc/stats/opentelemetry in multiple modules:
        google.golang.org/grpc v1.71.0 (/home/dev/go/pkg/mod/google.golang.org/[email protected]/stats/opentelemetry)
        google.golang.org/grpc/stats/opentelemetry v0.0.0-20240907200651-3ffb98b2c93a (/home/dev/go/pkg/mod/google.golang.org/grpc/stats/[email protected])

Ran the following to resolve:

# Drop the require for the standalone opentelemetry module
go mod edit -droprequire google.golang.org/grpc/stats/opentelemetry

# Clean up unused bits
go mod tidy

Reason being since gRPC v1.71.0 already vendored that package, we simply need to drop the split-off module from our go.mod

Related Issue

Fixes https://github.com/zarf-dev/zarf/security/dependabot/198

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide Steps followed

[netlify]

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	fbd7b7f
🔍 Latest deploy log	https://app.netlify.com/sites/zarf-docs/deploys/681e3b74605bf00008322e32

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[brandtkeller]

Patched version has been merged into cosign@main - the CVE does not impact Cosign or Zarf.