chore(deps): update submodules (#5162)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [actions/setup-go](https://redirect.github.com/actions/setup-go) |
action | minor | `v6.3.0` → `v6.4.0` |
|
[gcp/api/googleapis](https://redirect.github.com/googleapis/googleapis)
([changelog](https://redirect.github.com/googleapis/googleapis/compare/1e1ca41d507f31b9ae307efbe002af864358214b..775a3cb5d47dc07d3a18660cab9c4924e5231ad9))
| | digest | `1e1ca41` → `775a3cb` |
|
[github/codeql-action](https://redirect.github.com/github/codeql-action)
| action | minor | `v4.34.1` → `v4.35.1` |
| osv-schema |  | digest | `df53497` → `2a6a0b9` |
| [osv/osv-schema](https://redirect.github.com/ossf/osv-schema.git)
([changelog](https://redirect.github.com/ossf/osv-schema.git/compare/df534973d091209ed646dd4f4081c057d1f6ec2c..2a6a0b9b0ccd8b91eeec05081b2642f53cfbe81e))
| | digest | `df53497` → `2a6a0b9` |

---

### Release Notes

<details>
<summary>actions/setup-go (actions/setup-go)</summary>

###
[`v6.4.0`](https://redirect.github.com/actions/setup-go/releases/tag/v6.4.0)

[Compare
Source](https://redirect.github.com/actions/setup-go/compare/v6.3.0...v6.4.0)

##### What's Changed

##### Enhancement

- Add go-download-base-url input for custom Go distributions by
[@&#8203;gdams](https://redirect.github.com/gdams) in
[#&#8203;721](https://redirect.github.com/actions/setup-go/pull/721)

##### Dependency update

- Upgrade minimatch from 3.1.2 to 3.1.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot) in
[#&#8203;727](https://redirect.github.com/actions/setup-go/pull/727)

##### Documentation update

- Rearrange README.md, add advanced-usage.md by
[@&#8203;priyagupta108](https://redirect.github.com/priyagupta108) in
[#&#8203;724](https://redirect.github.com/actions/setup-go/pull/724)
- Fix Microsoft build of Go link by
[@&#8203;gdams](https://redirect.github.com/gdams) in
[#&#8203;734](https://redirect.github.com/actions/setup-go/pull/734)

##### New Contributors

- [@&#8203;gdams](https://redirect.github.com/gdams) made their first
contribution in
[#&#8203;721](https://redirect.github.com/actions/setup-go/pull/721)

**Full Changelog**:
<actions/setup-go@v6...v6.4.0>

</details>

<details>
<summary>github/codeql-action (github/codeql-action)</summary>

###
[`v4.35.1`](https://redirect.github.com/github/codeql-action/releases/tag/v4.35.1)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v4.35.0...v4.35.1)

- Fix incorrect minimum required Git version for [improved incremental
analysis](https://redirect.github.com/github/roadmap/issues/1158): it
should have been 2.36.0, not 2.11.0.
[#&#8203;3781](https://redirect.github.com/github/codeql-action/pull/3781)

###
[`v4.35.0`](https://redirect.github.com/github/codeql-action/releases/tag/v4.35.0)

[Compare
Source](https://redirect.github.com/github/codeql-action/compare/v4.34.1...v4.35.0)

- Reduced the minimum Git version required for [improved incremental
analysis](https://redirect.github.com/github/roadmap/issues/1158) from
2.38.0 to 2.11.0.
[#&#8203;3767](https://redirect.github.com/github/codeql-action/pull/3767)
- Update default CodeQL bundle version to
[2.25.1](https://redirect.github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.1).
[#&#8203;3773](https://redirect.github.com/github/codeql-action/pull/3773)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 6am on wednesday" in timezone
Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/google/osv.dev).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDAuMCIsInVwZGF0ZWRJblZlciI6IjQzLjEwMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->

Author: renovate-bot

.github/workflows/codeql-analysis.yml

@@ -43,7 +43,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+      uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1

.github/workflows/generate-protos.yml

@@ -46,7 +46,7 @@ jobs:
           cd gcp/api && poetry install
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: '1.26.1'
 

.github/workflows/lint.yaml

@@ -50,7 +50,7 @@ jobs:
       - name: Set up poetry
         run: poetry install
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: '>=1.26.1'
       - name: Set up terraform

.github/workflows/scorecards.yml

@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
         with:
           sarif_file: results.sarif

.github/workflows/snapshots.yml

@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: stable
           check-latest: true

gcp/api/googleapis

@@ -20,7 +20,7 @@ RUN apk add --no-cache git
 WORKDIR /src
 
 # Using osv-schema v1.7.3+
-RUN git clone https://github.com/ossf/osv-schema.git osv-schema && cd osv-schema && git checkout df534973d091209ed646dd4f4081c057d1f6ec2c
+RUN git clone https://github.com/ossf/osv-schema.git osv-schema && cd osv-schema && git checkout 2a6a0b9b0ccd8b91eeec05081b2642f53cfbe81e
 
 WORKDIR /src/osv-schema/tools/osv-linter