ci: govulncheck is failed with new vulnerability GO-2024-2687

[liudalibj]

fix the report issues from govulncheck CI.

for #1779

govulncheck is failed with error:

Vulnerability #1: GO-2024-2687
    HTTP/2 CONTINUATION flood in net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2687
  Module: golang.org/x/net
    Found in: golang.org/x/net@v0.19.0
    Fixed in: golang.org/x/net@v0.23.0
    Example traces found:
...

  Standard library
    Found in: net/http@go1.21.8
    Fixed in: net/http@go1.21.9
    Example traces found:
...

More details https://github.com/confidential-containers/cloud-api-adaptor/actions/runs/8593242256/job/23544455229?pr=1778

[stevenhorsman]

LGTM. Thanks DaLi!

[huoqifeng]

Sounds like this is not good:

ERROR: failed to solve: quay.io/confidential-containers/golang-fedora:1.21.9-38: failed to resolve source metadata for quay.io/confidential-containers/golang-fedora:1.21.9-38: quay.io/confidential-containers/golang-fedora:1.21.9-38: not found

[stevenhorsman]

This is my fault for suggesting DaLi update it. Maybe we have to do that as a separate bump as this image is only build after this PR is merged?

[liudalibj]

The quay.io/confidential-containers/golang-fedora:1.21.9-38 is not build yet, it should be triggered at https://github.com/confidential-containers/cloud-api-adaptor/blob/main/.github/workflows/build-golang-fedora.yaml after this PR be merged.
I think we can skip the e2e-test for this PR.

[huoqifeng]

OK, let's re-trigger the build if CI fails after merge because https://github.com/confidential-containers/cloud-api-adaptor/blob/main/.github/workflows/build-golang-fedora.yaml might be triggered later than caa.

[stevenhorsman]

Ok, I'll merge it and then check the tests

[stevenhorsman]

After I waited for the golang-fedora base image build to happen I triggered the nightly libvirt tests and the podvm image builders passed.

[huoqifeng]

LGTM