Drop the GO-2026-5932 openpgp exclusion once rekor releases the migration #6287

Summary

.github/workflows/security-scan.yml excludes GO-2026-5932 — golang.org/x/crypto/openpgp is deprecated by design, has no fixed version, and never will. The exclusion is currently correct, but it should not be permanent, and a suppression with no expiry tends to become one.

Why it exists

Nothing in ToolHive imports openpgp. It arrives four levels up:

pkg/skills/signer → sigstore-go/pkg/sign → rekor/pkg/pki → rekor/pkg/pki/pgp → golang.org/x/crypto/openpgp

rekor/pkg/pki is a pluggable signature-format registry, so importing it links every format, PGP included. There is no local call site to rewrite.

Every govulncheck trace is package-init reachability (signer.init calls sign.init, which eventually calls armor.init), not a call — the package is linked but never parses PGP data on any ToolHive path. The advisory is "unmaintained, unsafe by design" rather than a specific exploitable bug, and that risk only materialises when parsing untrusted PGP input.

What unblocks removal

Rekor already migrated to ProtonMail/go-crypto/openpgp in sigstore/rekor#2883, merged 2026-07-15. The latest release, v1.5.3, is from 2026-07-02 and predates it, so the fix is on main but unreleased.

Steps once a rekor release past v1.5.3 exists

1. Bump github.com/sigstore/rekor (indirect, currently v1.5.3) — likely via a sigstore-go bump rather than directly.
2. Confirm the advisory is gone: govulncheck ./... should no longer report GO-2026-5932.
3. Remove GO-2026-5932 from IGNORED_VULNS in .github/workflows/security-scan.yml, along with its justification block.

stacklok/toolhive-core carries the same exclusion for the same reason and needs the same treatment — it has its own go.mod, so it is a separate bump.

Context: #6286.