go.mod: apply `gomodjail:confined` to the global scope

> Looks like dependabot doesn't want `// gomodjail:confined` to be appended after `// indirect`.
So we will have to invert the gomodjail policy: Apply `gomodjail:confined` to the global scope, and then apply `gomodjail:unconfined` to a small set of dependencies

_Originally posted by @AkihiroSuda in https://github.com/lima-vm/lima/pull/3249#discussion_r1958878437_
            