Update to Go 1.21.6 and Alpine 3.19

[mrfelton]

Update to Go to v1.21.6

There was quite a bit required to get this to work, including:

Updating Go

Go has been updated to v1.21.6, and as a result we're also now running on the latest Alpine build, which address a number of known security vulnerabilities.

Updating all dependencies

In order to hit all of the transient dependencies that have known security issues, most of the direct dependencies had to be updated to latest versions.

Switching to doing linting using the golangci-lint official prebuilt docker image

To update to Go 1.21, we also had to update the linter. I spent a lot of time trying to get the existing linting setup to work, however unfortunately I just could not get it to build cleanly as things are. Given that the maintainers recommend against building from source and recognise that it often doesn't work, instead I have switched to using one of their recommended approaches as per https://golangci-lint.run/usage/install/. For some context, see

• Bump golangci-lint and remove unused tools vmware-tanzu/vm-operator#70
• Tools import appears to be invalid ryancurrah/gomodguard#33
• Download golangci-lint instead of building it kubernetes-sigs/cluster-api-provider-cloudstack#226
• 🌱 CI: Use script to download golangci-lint kubernetes-sigs/cluster-api-provider-vsphere#1862

Disabled some lint rules

With the linter updated, a number of new/changed rules started throwing issues. I fixed a couple of them but it was turning into a distraction. So, I have disabled three rules which we're currently not passing. depguard, goconst, gosec. My Go skill are lacking, so fixing these will take too long for me right now. Maybe someone that's more familiar with Go can re-enable these and fix the offending issues.

[guggero]

Thanks for the updates!
The package updates you mentioned could go into this PR as well if you feel like it. Or a separate one, whatever you prefer.

[mrfelton]

I've updated the PR to move to latest Go version (1.21.6). In order to do that, a lot of the other dependencies needed to be updated, so the scope of the PR has grown somewhat. But this does now address almost all of the known security issues from our dependencies. But there are some caveats - see updated issue description for details.

[guggero]

Thanks a lot for your investigations! Unfortunately the linter is a bit of a pain to handle sometimes...

[mrfelton]

All updates made @guggero . Thanks for the pointer on the linter issues. Removing the tools tag worked

[guggero]

Thanks a lot, LGTM 🎉