deps(go): bump module github.com/google/go-containerregistry to v0.21.7 - #9585

## What's Changed
* tarball: return error instead of panicking on missing rootfs.diff_ids by @iahsanGill in https://github.com/google/go-containerregistry/pull/2304
* gcrane: honor --platform flag in copy by @iahsanGill in https://github.com/google/go-containerregistry/pull/2307
* mutate: verify layer digests in Extract and Time by @momenashrafff in https://github.com/google/go-containerregistry/pull/2303
* tarball: close layer readers during Write by @nandbhat in https://github.com/google/go-containerregistry/pull/2308
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2311
* build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2312
* BUGFIX: Fail with error when read exceeds maximum by @inteon in https://github.com/google/go-containerregistry/pull/2328
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2327
* fix(name): anchor loopback registry detection by @rohan-patnaik in https://github.com/google/go-containerregistry/pull/2314
* Reject symlinks in OCI layout blobs by @mosskappa in https://github.com/google/go-containerregistry/pull/2306
* fix(crane): avoid creating export tar on pull failure by @Haihan-Jiang in https://github.com/google/go-containerregistry/pull/2318
* feat(kubernetes): allow ignoring pull secrets by @rohan-patnaik in https://github.com/google/go-containerregistry/pull/2315
* fix(name): preserve localhost registry references by @rohan-patnaik in https://github.com/google/go-containerregistry/pull/2316
* pkg/registry: export ErrNotFound by @malt3 in https://github.com/google/go-containerregistry/pull/2176
* pkg/registry: export RedirectError by @malt3 in https://github.com/google/go-containerregistry/pull/2177
* build(deps): bump the go-deps group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2343
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2344
* fix: prevent SSRF in google.List() pagination by @tufstraka in https://github.com/google/go-containerregistry/pull/2332
* internal/gzip: fix goroutine leak in ReadCloserLevel by @amarkdotdev in https://github.com/google/go-containerregistry/pull/2347
* fix(transport): apply refreshed bearer token after cross-host redirect by @64johnlee in https://github.com/google/go-containerregistry/pull/2337
* build(deps): bump the go-deps group across 3 directories with 4 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2348
* fix(tarball): normalize paths when matching files by @bstoll in https://github.com/google/go-containerregistry/pull/2334
* transport: do not re-attach bearer token after cross-host redirect by @evilgensec in https://github.com/google/go-containerregistry/pull/2349
* Bump CI go version to 1.26.4 by @Subserial in https://github.com/google/go-containerregistry/pull/2350

## New Contributors
* @momenashrafff made their first contribution in https://github.com/google/go-containerregistry/pull/2303
* @nandbhat made their first contribution in https://github.com/google/go-containerregistry/pull/2308
* @inteon made their first contribution in https://github.com/google/go-containerregistry/pull/2328
* @rohan-patnaik made their first contribution in https://github.com/google/go-containerregistry/pull/2314
* @mosskappa made their first contribution in https://github.com/google/go-containerregistry/pull/2306
* @Haihan-Jiang made their first contribution in https://github.com/google/go-containerregistry/pull/2318
* @tufstraka made their first contribution in https://github.com/google/go-containerregistry/pull/2332
* @amarkdotdev made their first contribution in https://github.com/google/go-containerregistry/pull/2347
* @64johnlee made their first contribution in https://github.com/google/go-containerregistry/pull/2337
* @bstoll made their first contribution in https://github.com/google/go-containerregistry/pull/2334

**Full Changelog**: https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7

## What's Changed
* fix: update dependencies to use new azure sdk components by @gaganhr94 in https://github.com/google/go-containerregistry/pull/2262
* transport: restore resp.Body in retryError so CheckError can parse it by @alliasgher in https://github.com/google/go-containerregistry/pull/2264
* pkg/registry: return 202 Accepted for PATCH chunk uploads by @alliasgher in https://github.com/google/go-containerregistry/pull/2265
* Follow OCI distribution spec for artifactType and annotations by @malt3 in https://github.com/google/go-containerregistry/pull/2269
* actions: attach Codecov token to coverage tests on main by @Subserial in https://github.com/google/go-containerregistry/pull/2270
* remote: use DeleteScope (with "delete" action) for manifest deletion by @alliasgher in https://github.com/google/go-containerregistry/pull/2266
* remote: limit concurrent layer pulls by @gnix0 in https://github.com/google/go-containerregistry/pull/2271
* pkg/registry: reject corrupt disk blobs by @gnix0 in https://github.com/google/go-containerregistry/pull/2272
* mutate: close layer readers during export by @gnix0 in https://github.com/google/go-containerregistry/pull/2277
* crane/flatten: preserve image media type when flattening by @alliasgher in https://github.com/google/go-containerregistry/pull/2267
* build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2273
* build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0 by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2278
* build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2280
* Replace go-homedir with os.UserHomeDir by @jammie-jelly in https://github.com/google/go-containerregistry/pull/2282
* pkg/name: only treat .localhost as non-HTTPS, not .local by @blackwell-systems in https://github.com/google/go-containerregistry/pull/2281
* transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL by @marwan9696 in https://github.com/google/go-containerregistry/pull/2285
* test(mutate): add Extract round-trip test for filesystem object preservation by @blackwell-systems in https://github.com/google/go-containerregistry/pull/2283
* experiments: remove deprecated support for estargz by @thaJeztah in https://github.com/google/go-containerregistry/pull/2288
* build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2289
* fix: limit HTTP response body reads to prevent OOM by @evilgensec in https://github.com/google/go-containerregistry/pull/2296
* build(deps): bump the go-deps group across 3 directories with 6 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2297
* transport: block redirects from token server to private/link-local addresses (SSRF fix) by @evilgensec in https://github.com/google/go-containerregistry/pull/2292
* pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract by @anishesg in https://github.com/google/go-containerregistry/pull/2279
* validate: skip non-layer layers by @imjasonh in https://github.com/google/go-containerregistry/pull/2298
* remote: validate foreign layer URLs to prevent SSRF (fixes #2259) by @evilgensec in https://github.com/google/go-containerregistry/pull/2293
* remote: block SSRF via private-IP Location headers in blob uploads by @adilburaksen in https://github.com/google/go-containerregistry/pull/2295
* fix(mutate): preserve config blob and layers for non-Docker OCI artifacts by @blackwell-systems in https://github.com/google/go-containerregistry/pull/2286
* fix: preserve per-occurrence layer identity in mutate.Image.Layers() by @iahsanGill in https://github.com/google/go-containerregistry/pull/2299
* transport: retry HTTP 429 (Too Many Requests) by @iahsanGill in https://github.com/google/go-containerregistry/pull/2301
* transport: allow bearer realm at same host:port as registry by @iahsanGill in https://github.com/google/go-containerregistry/pull/2302
* Update go version to 1.26.3 by @Subserial in https://github.com/google/go-containerregistry/pull/2300

## New Contributors
* @gaganhr94 made their first contribution in https://github.com/google/go-containerregistry/pull/2262
* @alliasgher made their first contribution in https://github.com/google/go-containerregistry/pull/2264
* @malt3 made their first contribution in https://github.com/google/go-containerregistry/pull/2269
* @gnix0 made their first contribution in https://github.com/google/go-containerregistry/pull/2271
* @blackwell-systems made their first contribution in https://github.com/google/go-containerregistry/pull/2281
* @marwan9696 made their first contribution in https://github.com/google/go-containerregistry/pull/2285
* @anishesg made their first contribution in https://github.com/google/go-containerregistry/pull/2279
* @adilburaksen made their first contribution in https://github.com/google/go-containerregistry/pull/2295
* @iahsanGill made their first contribution in https://github.com/google/go-containerregistry/pull/2299

**Full Changelog**: https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6