gh/2.55.0-r0: cve remediation

[octo-sts]

gh/2.55.0-r0: fix GHSA-cq38-jh5f-37mq

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/gh.advisories.yaml

[octo-sts]

Open AI suggestions to solve the build error:

The error message is: "fatal: detected dubious ownership in repository at '/github/home' To add an exception for this directory, call: git config --global --add safe.directory /github/home ERRO request failed error=\"Get \\\"./packages/apk-configuration\\\": unsupported protocol scheme \\\"\\\"\" method=GET url=./packages/apk-configuration WARN ignoring missing keys for ./packages: failed to perform key discovery: Get \"./packages/apk-configuration\": GET ./packages/apk-configuration giving up after 1 attempt(s): Get \"./packages/apk-configuration\": unsupported protocol scheme \"\" WARN # github.com/cli/cli/v2/pkg/cmd/attestation/verification WARN pkg/cmd/attestation/verification/mock_verifier.go:30:15: cannot use statement (variable of type *in_toto.Statement) as *\"github.com/in-toto/attestation/go/v1\".Statement value in struct literal WARN exit status 1 WARN build.go: building task `bin/gh` failed. WARN make: *** [Makefile:17: bin/gh] Error 1 ERRO ERROR: failed to build package. the build environment has been preserved: INFO   workspace dir: /temp/melange-workspace-2082141532 INFO   guest dir: /temp/melange-guest-3249041124 ERRO failed to build package: unable to run package gh pipeline: unable to run pipeline: exit status 2 make[1]: *** [Makefile:111: packages/aarch64/gh-2.55.0-r1.apk] Error 1 make[1]: Leaving directory '/github/home' make: *** [Makefile:101: package/gh] Error 2"

To fix this error:
1. Run `git config --global --add safe.directory /github/home`.
2. Ensure the URL for `./packages/apk-configuration` is correct and uses a supported protocol.
3. Correct the type mismatch in `mock_verifier.go`.
4. Verify Makefile targets and dependencies.

[kranurag7]

upstream patch (ref: cli/cli#9566) bumping sigstore-go and it involves a bit more than bumping the dependency. We'll probably need a patch for this.

[kranurag7]

closing this one given it's already bumped to a new version via #27953