deps(go): bump module github.com/google/go-containerregistry to v0.21.9 - #10019

## What's Changed
* actions: pin slsa generator by version by @Subserial in https://github.com/google/go-containerregistry/pull/2395
* fix: prevent data race on scope refreshes within remote.writer by @Subserial in https://github.com/google/go-containerregistry/pull/2396
* fix: remove '.' from unsafe path prefixes by @Subserial in https://github.com/google/go-containerregistry/pull/2400
* build(deps): bump the actions group with 3 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2398


**Full Changelog**: https://github.com/google/go-containerregistry/compare/v0.21.8...v0.21.9

The artifacts attached to this release are missing SLSA provenance, see #2390.

## What's Changed
* build(deps): bump the go-deps group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2353
* build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2367
* build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2368
* build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2363
* build(deps): bump the go-deps group across 3 directories with 7 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2377
* build(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2375
* Reject unsafe Windows archive paths in Extract by @Haihan-Jiang in https://github.com/google/go-containerregistry/pull/2330
* feat(goreleaser): add loong64 build support for crane/gcrane/krane by @xuxiaowei-com-cn in https://github.com/google/go-containerregistry/pull/2358
* Document tag and digest reference semantics by @Haihan-Jiang in https://github.com/google/go-containerregistry/pull/2325
* remote: release pull limiter slot when body is read to EOF by @knQzx in https://github.com/google/go-containerregistry/pull/2373
* tarball: bounds-check layer index in uncompressed LayerByDiffID by @arpitjain099 in https://github.com/google/go-containerregistry/pull/2370
* authn: read Podman auth from XDG config by @vigneshakaviki in https://github.com/google/go-containerregistry/pull/2379
* transport: per-host bearer token exchange on cross-host redirect by @amitzig in https://github.com/google/go-containerregistry/pull/2360
* mutate: bounds-check layer index when building rebase addendums by @arpitjain099 in https://github.com/google/go-containerregistry/pull/2371
* fix(daemon): copy ExposedPorts from source config in computeImageConfig by @x64vps in https://github.com/google/go-containerregistry/pull/2356
* feat(remote): add WithReferrersTagFallback option by @kevinmdavis in https://github.com/google/go-containerregistry/pull/2366
* mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract by @sadmanf in https://github.com/google/go-containerregistry/pull/2372
* tarball: use correct file extension for zstd/uncompressed by @milas in https://github.com/google/go-containerregistry/pull/2382
* build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2380
* actions: update actions to be pinned by hash by @Subserial in https://github.com/google/go-containerregistry/pull/2384
* Bump go version to 1.26.5 by @Subserial in https://github.com/google/go-containerregistry/pull/2388

## New Contributors
* @xuxiaowei-com-cn made their first contribution in https://github.com/google/go-containerregistry/pull/2358
* @knQzx made their first contribution in https://github.com/google/go-containerregistry/pull/2373
* @arpitjain099 made their first contribution in https://github.com/google/go-containerregistry/pull/2370
* @vigneshakaviki made their first contribution in https://github.com/google/go-containerregistry/pull/2379
* @amitzig made their first contribution in https://github.com/google/go-containerregistry/pull/2360
* @x64vps made their first contribution in https://github.com/google/go-containerregistry/pull/2356
* @kevinmdavis made their first contribution in https://github.com/google/go-containerregistry/pull/2366
* @sadmanf made their first contribution in https://github.com/google/go-containerregistry/pull/2372

**Full Changelog**: https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8