Stop bumping go directive unless necessitated by other dependencies

[kaovilai]

@kaovilai ➜ /workspaces/sdk (961a644) $ go mod graph | grep go@1.23.3 | cut -d ' ' -f 2
go@1.23.3
toolchain@go1.23.3
@kaovilai ➜ /workspaces/sdk (961a644) $ go mod graph | grep go@1.23. | grep -v /sdk | cut -d ' ' -f 2
go@1.23.2
go@1.23.1
toolchain@go1.23.3

Per above, this repo go.mod as it currently stands should have go directive of 1.23.2, not 1.23.3.

This repo by itself should not be enforcing minimum on other repositories importing it. Stop spreading "minimum virus"

toolchain version used will be defined outside of go.mod ideally, such as by installing a newer compatible go toolchain to ci/cd/development env.

Failing that, toolchain directive should be used instead of go directive for bumping versions to not cascade minimum versions to importing dependencies.

toolchain directive, in contrast to the go directive, applies only to the current module (the one defined by the go.mod file). It suggests the toolchain to be used when in that very module, and doesn't propagate to other modules.

High profile repos that have removed/reduced minimum go patch version per user requests

• deps: Remove Go minor version from go.mods grpc/grpc-go#7831 motivation

Being proactive to prevent following from reoccuring

• deps: Remove Go patch version from go.mods kopia/kopia#4292
• Do not set minimum go toolchain version in release branches. vmware-tanzu/velero#8397
• Bump github.com/vmware-tanzu/velero from 1.14.0 to 1.15.0 kubevirt/kubevirt-velero-plugin#292 (comment)

[kaovilai]

@kaovilai ➜ /workspaces/sdk (main) $ go get go@1.23.2 toolchain@1.23.4 && go mod tidy && cat go.mod
go: downgraded go 1.23.3 => 1.23.2
go: added toolchain go1.23.4
...
module chainguard.dev/sdk

go 1.23.2

toolchain go1.23.4