fix(deps): take selfupdate-cosign v0.3.4 and the go-selfupdate fork

[teemow]

Problem

govulncheck reports GO-2026-5932 (golang.org/x/crypto/openpgp, unmaintained and unsafe by design) as reachable: creativeprojects/go-selfupdate pulls in its PGP verification path, and selfupdate-cosign up to v0.3.3 depended on it. See giantswarm/selfupdate-cosign#17.

Proposed solution

• github.com/giantswarm/selfupdate-cosign v0.3.2 → v0.3.4, which builds on the fork github.com/giantswarm/go-selfupdate v1.6.1 (its own module path, without the openpgp path).
• Every own import of github.com/creativeprojects/go-selfupdate changed to github.com/giantswarm/go-selfupdate: selfupdate-cosign's API now takes the fork's types.
• No replace directive: go install of a released module ignores them, which is why the fork carries its own module path.
• go mod tidy.

Acceptance criteria

• govulncheck ./... before: Your code is affected by 1 vulnerability from 1 module. — GO-2026-5932, traced through update.init calls selfupdate.init, which calls openpgp.init
• govulncheck ./... after: Your code is affected by 0 vulnerabilities. (GO-2026-5932 remains only at module level: golang.org/x/crypto is required, openpgp is not imported)
• go mod graph no longer contains creativeprojects/go-selfupdate
• go vet ./... and go test ./... pass
• CI green, merged, release candidate cut

This PR was written by an agent.