internal/tools: update deps to pass security vulns #11

	# Copyright 2023 The Cockroach Authors
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.
	#
	# SPDX-License-Identifier: Apache-2.0

	# This is our top-level workflow that kicks off the various go- workflows.
	name: Golang
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true
	on:
	# Since we use the merge queue to push and there are no observable
	# side-effects of running a test-only workflow, we don't respond to
	# push events.
	merge_group: # Enable merge queue
	pull_request:
	paths:
	- 'go.mod'
	- 'go.sum'
	- '*/.go'
	- '.github/workflows/go*.yaml'
	push:
	branches: [ main ]
	tags: [ 'v..*' ]
	jobs:
	go-codeql:
	uses: ./.github/workflows/go-codeql.yaml
	permissions:
	contents: read
	security-events: write
	secrets: inherit

	go-tests:
	uses: ./.github/workflows/go-tests.yaml
	# We use the merge queue prior to pushing to a branch, so there's no
	# reason to repeat tests that just ran.
	if: ${{ github.event_name != 'push' }}
	permissions:
	contents: read
	packages: read
	statuses: write
	secrets: inherit

Provide feedback