build(deps): consolidate dependabot updates into one PR

[handcaught]

Consolidates five dependabot PRs that could not land independently: #282 and #272 both rewrote sdk/go.mod, and #282 and #273 both rewrote workflow/go.mod.

Supersedes and closes #272, #273, #275, #276, #282.

Go modules

Direct bumps — indirect churn follows from go mod tidy across all four modules:

dependency	version	modules
github.com/landlock-lsm/go-landlock	v0.9.0	root
github.com/testcontainers/testcontainers-go	v0.43.0	root
github.com/zclconf/go-cty	v1.19.0	root, workflow
golang.org/x/mod	v0.38.0	root, workflow, tools
golang.org/x/net	v0.57.0	root, sdk

Only dependencies already present in each module's go.mod were bumped — no blanket go get -u, so nothing new is pulled in.

GitHub Actions

• actions/checkout v6.0.2 → v7.0.0 (17 uses across 3 workflows)
• actions/cache v5 → v6 (7 uses across 2 workflows)

Deliberately excluded: cosign v3.1.2

github.com/sigstore/cosign/v3 stays at v3.1.0.

go.work unifies module versions across the four modules, so a root-module bump changes what tools/ resolves even when tools/go.mod is untouched. cosign v3.1.2 pulls opa v1.17.1 and sigs.k8s.io/release-utils v0.12.4, both requiring tablewriter v1.1.4. But golangci-lint v1.64.8 pins revive v1.7.0, which uses the tablewriter v0.0.5 API removed in v1.x (SetBorder, AppendBulk, …). make ci fails building bin/golangci-lint:

revive@v1.7.0/formatter/friendly.go:134:8: table.SetBorder undefined
  (type *tablewriter.Table has no field or method SetBorder)

Confirmed against a clean main worktree — that builds fine at tablewriter v0.0.5, so this is caused by the cosign bump and is not pre-existing.

Landing the cosign patch requires upgrading golangci-lint to a release whose revive supports tablewriter v1.x, which is a v1 → v2 config migration and does not belong in a dependency sweep.

Worth considering separately: tools is a build-tooling module sharing a workspace with the shipped modules, so its linter's dependency graph constrains the product's. Removing it from go.work would decouple them.

Verification

make ci and make vuln-scan both pass locally (ci=0, vuln=0).