Bump the go-deps group across 1 directory with 5 updates

[dependabot]

Bumps the go-deps group with 5 updates in the / directory:

Package	From	To
filippo.io/age	1.2.1	1.3.1
github.com/fluxcd/pkg/auth	0.38.2	0.39.0
github.com/fluxcd/pkg/runtime	0.100.2	0.102.0
github.com/fluxcd/pkg/ssa	0.67.1	0.69.0
github.com/google/cel-go	0.26.1	0.27.0

Updates filippo.io/age from 1.2.1 to 1.3.1

Release notes

Sourced from filippo.io/age's releases.

v1.3.1 is a minor release to restore version injection from downstream package build processes.

See the v1.3.0 release notes for an overview of recent additions.

age v1.3.0: post-quantum (and more)!

Exactly six years after the first age beta release, v1.3.0 brings post-quantum resistance to age, along with a couple long-requested features, built-in support for recipients compatible with hardware plugins, I/O API improvements, and many usability enhancements.

Post-quantum recipients

age now has native post-quantum recipients based on HPKE with a hybrid ML-KEM-768 KEM. The recipients start with age1pq1..., and the identities start with AGE-SECRET-KEY-PQ-1....

To generate a post-quantum keypair:

$ age-keygen -pq

If you have your own age implementation, C2SP has the specification, and CCTV has test vectors for the new hybrid recipient types.

(If you are using an older age client, an optional plugin is available that provides out-of-the-box support for encryption to hybrid recipients. Hybrid identities can be converted to work with the plugin with age-plugin-pq -identity.)

New I/O APIs

The new DecryptReaderAt API implements seeking decryption, which can be used with zip.NewReader.

The new EncryptReader API implements pull-based encryption by wrapping an io.Reader, as opposed to wrapping an io.Writer like Encrypt.

age-inspect

The new age-inspect(1) tool presents the metadata of an age file without decrypting it.

hello.age is an age file, version "age-encryption.org/v1".
This file is ASCII-armored.
This file is encrypted to the following recipient types:

"mlkem768x25519"

This file uses post-quantum encryption.
Size breakdown (assuming it decrypts successfully):
Header                      1627 bytes
Armor overhead              1350 bytes
Encryption overhead           32 bytes
Payload                     1959 bytes
                    -------------------

</tr></table>

... (truncated)

Commits

• b8564ad .github/workflows: inject version into source release artifact
• e4c611f cmd,extra: restore the Version link-time variable
• 6a8065f SIGSUM.md: update policy for v1.3.0
• 50a600e .github/workflows: improve release reproducibility
• 13aab81 .github/workflows: build and release source tarball
• 52338c2 .github/workflows: enable GitHub artifact attestation
• b70af41 cmd/age: don't output binary plaintext to terminal
• 4202739 internal/stream: fix DecryptReaderAt concurrency
• da21917 age: add ExampleDecryptReaderAt with zip.NewReader
• 2ff5d34 age: add DecryptReaderAt
• Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/auth from 0.38.2 to 0.39.0

Commits

• 572c0fc Merge pull request #1058 from fluxcd/dependabot/github_actions/ci-30d17f4058
• ac6c615 build(deps): bump the ci group across 1 directory with 4 updates
• 7dedb99 Merge pull request #1067 from fluxcd/git-unify
• 0e641e6 git: merge gogit module into git module
• fd7874f Merge pull request #1055 from yozel/yozel/bug-fix
• 2cd3485 Fix incorrect metadata patch generation
• f92d4c6 Merge pull request #1064 from fluxcd/gh-refactor
• 6b57946 git: refactor GitHub App auth to use go-github direclty
• 3f44dbd Merge pull request #1063 from fluxcd/test-chunks
• 387d652 Revert "Use large runners for tests"
• Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/runtime from 0.100.2 to 0.102.0

Commits

• 197b0fd Merge pull request #1120 from fluxcd/release-main
• 7c22edb Fix release preview workflow
• cf1b387 Prepare for release
• 21b9098 Merge pull request #1118 from alvaroaleman/disable-clientside
• efbb0c9 Kubeconfig: Disable clientside ratelimtier if flowcontrol is supported
• 0ce88c6 Merge pull request #1110 from fluxcd/release-main
• 66c8a30 Prepare for release
• 1737eab cmd: fix not removing v prefix
• 52bc1ed Merge pull request #1116 from fluxcd/cmd-bump
• 5537abd cmd: introduce command for bumping modules in controller repos
• Additional commits viewable in compare view

Updates github.com/fluxcd/pkg/ssa from 0.67.1 to 0.69.0

Commits

• 0ce88c6 Merge pull request #1110 from fluxcd/release-main
• 66c8a30 Prepare for release
• 1737eab cmd: fix not removing v prefix
• 52bc1ed Merge pull request #1116 from fluxcd/cmd-bump
• 5537abd cmd: introduce command for bumping modules in controller repos
• b1df0c1 Merge pull request #1112 from fluxcd/ssa-err-msg
• b69e69a ssa: fix timeout error not mentioning object
• f6b5193 Merge pull request #1111 from fluxcd/FeatureGateDirectSourceFetch
• 199624d runtime: Add FeatureGateDirectSourceFetch
• 49af223 Merge pull request #1108 from fluxcd/fix-cmd
• Additional commits viewable in compare view

Updates github.com/google/cel-go from 0.26.1 to 0.27.0

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.27.0

Release Summary

This release focuses on improving developer tooling and stability. Key highlights include significant enhancements to the REPL (YAML configuration support and parse-only evaluation), the addition of cost estimation for regex operations, and improved test coverage reporting.

On the stability front, this release addresses race conditions in reference types, improves namespace resolution, and ensures formatting directives align strictly with the CEL specification.

Note: This release includes a breaking change regarding how types are handled as variables. Please review the "Breaking Changes" section below.

⚠ Breaking Changes

Remove types as variables: The logic for handling types has been relaxed to support safe rollout of feature packages which introduce new types whose names may collide with existing variables. Please review your policies if you relied on types behaving strictly as variables in previous versions. [PR #1262](google/cel-go#1262)

Features & Enhancements

REPL & Tooling

• YAML Configuration: The REPL now supports reading and writing YAML environment configurations. [PR #1250](google/cel-go#1250)

• Parse-Only Mode: Added parse-only evaluation capabilities to the REPL. [PR #1254](google/cel-go#1254)

• Test Coverage: Introduced logic for CEL test coverage calculation and updated the reporter to handle error/unknown scenarios.[PR #1209](google/cel-go#1209) & [PR #1215](google/cel-go#1215)

Core Library

• Regex Costing: Added support for cost estimation and tracking within the regex library. [PR #1200](google/cel-go#1200)

• JSON Type Exposure: Exposed CEL JSON types to assist developers in converting to native values. [PR #1261](google/cel-go#1261)

• Policy Composition: Source information is now preserved during CEL policy composition, aiding in debugging. [PR #1253](google/cel-go#1253)

Extensibility:

• Updated extension option factory to resolve by ID (#1249).

• Refactored match output compiling to accept user-defined logic (#1246).

• Exposed Match source ID to callers (#1227).

Build & Maintenance

• Bazel: Migrated to use Bazel module only and improved configuration for dependent builds. [PR #1231](google/cel-go#1231) & [PR #1228](google/cel-go#1228)

• Cleanup: Removed strcase dependency, removed AppEngine code from REPL, and performed general linting. [PR #1230](google/cel-go#1230), #1216, #1251

Bug Fixes

• Concurrency: Fixed a race condition in the checker regarding reference types. [PR #1224](google/cel-go#1224)

• Namespace Resolution: Addressed an issue with namespace resolution. [PR #1256](google/cel-go#1256)

• Spec Compliance: Fixed formatting directives to fully support requirements documented in the cel-spec. [PR #1232](google/cel-go#1232)

... (truncated)

Commits

• 450089b Preserve source information during CEL policy composition. (#1253)
• c66b313 Remove types as variables to allow user-defined variables to shadow type decl...
• bff3a72 Expose the CEL JSON types to assist with conversion to native values (#1261)
• 559cbc9 Remove errant diff checked into a prior PR (#1260)
• fe26efa Simplify the disambiguation logic to a single boolean (#1263)
• 52280ba Clean up unused source info after checker rewrites the AST. (#1258)
• 3cb5705 Namespace resolution fix (#1256)
• 409bcbe Refactor match output compiling to accept user-defined logic. (#1246)
• e9f15ea Enable two var comprehension conformance tests. (#1255)
• 057fa1a Add parse only evaluation to REPL (#1254)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.