fix(deps): update go

Signed-off-by: Renovate Bot <bot@renovateapp.com>

go.mod

@@ -7,10 +7,10 @@ require (
 	github.com/go-openapi/runtime v0.25.0
 	github.com/google/go-cmp v0.5.9
 	github.com/google/trillian v1.5.1-0.20220819043421-0a389c4bb8d9 // indirect
-	github.com/in-toto/in-toto-golang v0.6.1-0.20230209184401-f8269f61247e
-	github.com/secure-systems-lab/go-securesystemslib v0.4.0
+	github.com/in-toto/in-toto-golang v0.7.0
+	github.com/secure-systems-lab/go-securesystemslib v0.5.0
 	github.com/sigstore/rekor v1.0.1
-	github.com/sigstore/sigstore v1.5.1
+	github.com/sigstore/sigstore v1.6.0
 )
 
 require (
@@ -19,10 +19,10 @@ require (
 	github.com/google/go-containerregistry v0.13.0
 	github.com/gorilla/mux v1.8.0
 	github.com/sigstore/cosign v1.13.1
-	github.com/sigstore/cosign/v2 v2.0.0-rc.2
-	github.com/slsa-framework/slsa-github-generator v1.4.0
+	github.com/sigstore/cosign/v2 v2.0.0
+	github.com/slsa-framework/slsa-github-generator v1.5.0
 	github.com/spf13/cobra v1.6.1
-	golang.org/x/mod v0.8.0
+	golang.org/x/mod v0.9.0
 	sigs.k8s.io/release-utils v0.7.3
 )
 
@@ -180,7 +180,7 @@ require (
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20230209215440-0dfe4f8abfcc // indirect
 	google.golang.org/grpc v1.53.0 // indirect
-	google.golang.org/protobuf v1.28.1
+	google.golang.org/protobuf v1.29.0
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect