deps(go): bump module github.com/google/go-containerregistry to v0.21.8 - #9770

The artifacts attached to this release are missing SLSA provenance, see #2390.

## What's Changed
* build(deps): bump the go-deps group across 1 directory with 3 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2353
* build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2367
* build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2368
* build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2363
* build(deps): bump the go-deps group across 3 directories with 7 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2377
* build(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2375
* Reject unsafe Windows archive paths in Extract by @Haihan-Jiang in https://github.com/google/go-containerregistry/pull/2330
* feat(goreleaser): add loong64 build support for crane/gcrane/krane by @xuxiaowei-com-cn in https://github.com/google/go-containerregistry/pull/2358
* Document tag and digest reference semantics by @Haihan-Jiang in https://github.com/google/go-containerregistry/pull/2325
* remote: release pull limiter slot when body is read to EOF by @knQzx in https://github.com/google/go-containerregistry/pull/2373
* tarball: bounds-check layer index in uncompressed LayerByDiffID by @arpitjain099 in https://github.com/google/go-containerregistry/pull/2370
* authn: read Podman auth from XDG config by @vigneshakaviki in https://github.com/google/go-containerregistry/pull/2379
* transport: per-host bearer token exchange on cross-host redirect by @amitzig in https://github.com/google/go-containerregistry/pull/2360
* mutate: bounds-check layer index when building rebase addendums by @arpitjain099 in https://github.com/google/go-containerregistry/pull/2371
* fix(daemon): copy ExposedPorts from source config in computeImageConfig by @x64vps in https://github.com/google/go-containerregistry/pull/2356
* feat(remote): add WithReferrersTagFallback option by @kevinmdavis in https://github.com/google/go-containerregistry/pull/2366
* mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract by @sadmanf in https://github.com/google/go-containerregistry/pull/2372
* tarball: use correct file extension for zstd/uncompressed by @milas in https://github.com/google/go-containerregistry/pull/2382
* build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2380
* actions: update actions to be pinned by hash by @Subserial in https://github.com/google/go-containerregistry/pull/2384
* Bump go version to 1.26.5 by @Subserial in https://github.com/google/go-containerregistry/pull/2388

## New Contributors
* @xuxiaowei-com-cn made their first contribution in https://github.com/google/go-containerregistry/pull/2358
* @knQzx made their first contribution in https://github.com/google/go-containerregistry/pull/2373
* @arpitjain099 made their first contribution in https://github.com/google/go-containerregistry/pull/2370
* @vigneshakaviki made their first contribution in https://github.com/google/go-containerregistry/pull/2379
* @amitzig made their first contribution in https://github.com/google/go-containerregistry/pull/2360
* @x64vps made their first contribution in https://github.com/google/go-containerregistry/pull/2356
* @kevinmdavis made their first contribution in https://github.com/google/go-containerregistry/pull/2366
* @sadmanf made their first contribution in https://github.com/google/go-containerregistry/pull/2372

**Full Changelog**: https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8

## What's Changed
* tarball: return error instead of panicking on missing rootfs.diff_ids by @iahsanGill in https://github.com/google/go-containerregistry/pull/2304
* gcrane: honor --platform flag in copy by @iahsanGill in https://github.com/google/go-containerregistry/pull/2307
* mutate: verify layer digests in Extract and Time by @momenashrafff in https://github.com/google/go-containerregistry/pull/2303
* tarball: close layer readers during Write by @nandbhat in https://github.com/google/go-containerregistry/pull/2308
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2311
* build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2312
* BUGFIX: Fail with error when read exceeds maximum by @inteon in https://github.com/google/go-containerregistry/pull/2328
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2327
* fix(name): anchor loopback registry detection by @rohan-patnaik in https://github.com/google/go-containerregistry/pull/2314
* Reject symlinks in OCI layout blobs by @mosskappa in https://github.com/google/go-containerregistry/pull/2306
* fix(crane): avoid creating export tar on pull failure by @Haihan-Jiang in https://github.com/google/go-containerregistry/pull/2318
* feat(kubernetes): allow ignoring pull secrets by @rohan-patnaik in https://github.com/google/go-containerregistry/pull/2315
* fix(name): preserve localhost registry references by @rohan-patnaik in https://github.com/google/go-containerregistry/pull/2316
* pkg/registry: export ErrNotFound by @malt3 in https://github.com/google/go-containerregistry/pull/2176
* pkg/registry: export RedirectError by @malt3 in https://github.com/google/go-containerregistry/pull/2177
* build(deps): bump the go-deps group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2343
* build(deps): bump the actions group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2344
* fix: prevent SSRF in google.List() pagination by @tufstraka in https://github.com/google/go-containerregistry/pull/2332
* internal/gzip: fix goroutine leak in ReadCloserLevel by @amarkdotdev in https://github.com/google/go-containerregistry/pull/2347
* fix(transport): apply refreshed bearer token after cross-host redirect by @64johnlee in https://github.com/google/go-containerregistry/pull/2337
* build(deps): bump the go-deps group across 3 directories with 4 updates by @dependabot[bot] in https://github.com/google/go-containerregistry/pull/2348
* fix(tarball): normalize paths when matching files by @bstoll in https://github.com/google/go-containerregistry/pull/2334
* transport: do not re-attach bearer token after cross-host redirect by @evilgensec in https://github.com/google/go-containerregistry/pull/2349
* Bump CI go version to 1.26.4 by @Subserial in https://github.com/google/go-containerregistry/pull/2350

## New Contributors
* @momenashrafff made their first contribution in https://github.com/google/go-containerregistry/pull/2303
* @nandbhat made their first contribution in https://github.com/google/go-containerregistry/pull/2308
* @inteon made their first contribution in https://github.com/google/go-containerregistry/pull/2328
* @rohan-patnaik made their first contribution in https://github.com/google/go-containerregistry/pull/2314
* @mosskappa made their first contribution in https://github.com/google/go-containerregistry/pull/2306
* @Haihan-Jiang made their first contribution in https://github.com/google/go-containerregistry/pull/2318
* @tufstraka made their first contribution in https://github.com/google/go-containerregistry/pull/2332
* @amarkdotdev made their first contribution in https://github.com/google/go-containerregistry/pull/2347
* @64johnlee made their first contribution in https://github.com/google/go-containerregistry/pull/2337
* @bstoll made their first contribution in https://github.com/google/go-containerregistry/pull/2334

**Full Changelog**: https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7