chore(deps): refresh Go module dependencies

[jmgilman]

Summary

• consolidate the remaining Go Dependabot queue across all six modules
• update direct and transitive module graphs, including OPA 1.19.0, Sigstore 1.10.9, sigstore-go 1.3.0, go-tuf 2.4.2, gRPC 1.83.0, OTel 1.45.0, ORAS 2.6.2, and x/crypto 0.54.0
• retain the compatible OTel HTTP instrumentation selected by Testcontainers instead of forcing an incompatible blanket build-list upgrade
• preserve local replacement placeholders for the root module and the gittuf fork

This supersedes the remaining open Go Dependabot PRs.

Verification

• mise exec -- moon run :tidy --summary minimal
• go mod verify in all six modules
• mise exec -- moon run root:check --summary minimal (49 tasks passed, including lint, unit tests, Docker-backed integration tests, builds, and docs)