Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

* go.mod: use toolchain directive to decouple CI version from minimum

See also: #722

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

* ci: test against oldstable and stable Go versions

Add a Go version matrix to the test workflow using the oldstable and
stable aliases from actions/setup-go. This validates compatibility
across the two most recent Go release series without hardcoding
versions or requiring manual updates.

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

* Drop specifying the toolchain

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

* Bump golangci-lint

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

---------

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

…727)

Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.10.4 to 1.10.5.
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.10.4...v1.10.5)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.10.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Radoslav Dimitrov <radoslav@stacklok.com>

…rom 0.10.0 to 0.11.0 (#729)

chore(deps): bump github.com/secure-systems-lab/go-securesystemslib

Bumps [github.com/secure-systems-lab/go-securesystemslib](https://github.com/secure-systems-lab/go-securesystemslib) from 0.10.0 to 0.11.0.
- [Release notes](https://github.com/secure-systems-lab/go-securesystemslib/releases)
- [Commits](secure-systems-lab/go-securesystemslib@v0.10.0...v0.11.0)

---
updated-dependencies:
- dependency-name: github.com/secure-systems-lab/go-securesystemslib
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

We've been seeing `Failed to verify %s with key ID %s` a bunch in the logs from a service of ours that's consuming a TUF root, and it's a bit confusing to see what appears to be a `fmt`-style line that isn't actually `fmt`ed. This PR changes that `log.Info` call to work like the one a bit below it for when a key ID is verified for the role.

Signed-off-by: Andrew Bayer <andrew.bayer@gmail.com>

…732)

Bumps [github.com/sigstore/sigstore](https://github.com/sigstore/sigstore) from 1.10.5 to 1.10.6.
- [Release notes](https://github.com/sigstore/sigstore/releases)
- [Commits](sigstore/sigstore@v1.10.5...v1.10.6)

---
updated-dependencies:
- dependency-name: github.com/sigstore/sigstore
  dependency-version: 1.10.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>