fix codegen cycle, fix govulncheck findings

[charludo]

Instead of just bumping the dependency, this PR includes a second commit that breaks a cycle we had when running just codegen.

Previously,

• contrast.node-installer inherits vendorHash from contrast.contrast (as do cli, e2e, resourcegen)
• to update this one, shared vendorHash, building nodeinstaller is required, because the reference-values depend on it, and e.g. the cli requires those to build
• this requires the vendorHash already be correct

Fixed it by moving from pre/postPatch to pre/postConfigure hooks. This causes them to no longer propagate into the goModules vendorHash. They still effect our package's output hashes, of course.

[sespiros]

Nice! I am curious how we did the Go updates with that dep cycle in place...