Update certificate-transparency-go to get static/tiled log support

[aarongable]

Update github.com/google/certificate-transparency-go from v1.1.6 to v1.3.1. This updates the loglist file schema to recognize logs which are tagged as being tiled logs / implementing the static CT API.

Transitively update:

• github.com/go-sql-driver/mysql from v1.7.1 to v1.8.1
• github.com/prometheus/client_golang from v1.15.1 to v1.22.0
• github.com/prometheus/client_model from v0.4.0 to v0.6.1
• go.opentelemetry.io/otel from v1.30.0 to v1.31.0
• google.golang.org/grpc from v1.66.1 to v1.69.4
• google.golang.org/protobuf from v1.34.2 to v1.36.5
• and a variety of indirect dependencies

Remove one indirect dependency:

• github.com/matttproud/golang_protobuf_extensions

Add two new indirect dependencies:

• filippo.io/[email protected] (used by go-sql-driver to handle mariadb's custom encryption implementation)
• github.com/munnerz/[email protected] (previously inlined into prometheus/common)

Also fix two unit tests which need minor modifications to work with updated type signatures and behavior.

Part of #7872

[jsha]

I was kinda surprised by some of the new dependencies. Some go mod why:

jsha@chitin:~/boulder$ go mod why github.com/munnerz/goautoneg
# github.com/munnerz/goautoneg
github.com/letsencrypt/boulder/akamai
github.com/prometheus/client_golang/prometheus
github.com/prometheus/common/expfmt
github.com/munnerz/goautoneg
jsha@chitin:~/boulder$ go mod why github.com/klauspost/compress/zstd
# github.com/klauspost/compress/zstd
github.com/letsencrypt/boulder/cmd
github.com/prometheus/client_golang/prometheus/promhttp
github.com/klauspost/compress/zstd
jsha@chitin:~/boulder$ go mod why github.com/matttproud/golang_protobuf_extensions
go: downloading github.com/matttproud/golang_protobuf_extensions v1.0.1
# github.com/matttproud/golang_protobuf_extensions
(main module does not need package github.com/matttproud/golang_protobuf_extensions)
jsha@chitin:~/boulder$ go mod why k8s.io/klog/v2
# k8s.io/klog/v2
github.com/letsencrypt/boulder/ctpolicy/loglist
github.com/google/certificate-transparency-go/loglist3
k8s.io/klog/v2

So prometheus is responsible for our new dependencies on zstd and goautoneg. I'd like to dig into that repository's history and see why, and if there is an alternative.

Similarly, it's a little surprising to me that certificate-transparency-go requires k8s.io/klog, and I'd love to see if that dependency can be excised.

Still I don't think those need to block this PR.

[jsha]

Yeesh, I read the diff wrong for a few of these:

github.com/matttproud/golang_protobuf_extensions

This dependency is removed, yay!

k8s.io/klog/v2

We've had this dependency for a while and it's just being modified.

[jsha]

github.com/munnerz/goautoneg

This package was originally inlined into the prometheus/common repo, and was changed to depend on an identical, but external, package in prometheus/common#625. It's an HTTP Content-Type negotiation library.

It's used in prometheus/common/expfmt as part of a Negotiate function that takes an HTTP header: https://github.com/prometheus/common/blob/8de85c23e0a24867586e51006eb260b57a10cc78/expfmt/encode.go#L60-L68

That Negotiate function isn't called from prometheus/client_golang, but a separate MetricFamilyToText is called: https://github.com/prometheus/client_golang/blob/96a5ad6ef56e0d41d3bf06ba0478b34a0c718a92/prometheus/registry.go#L605-L606

So, it's a dependency that's not strictly needed, but a PR to separate out its use in the prometheus packages would probably be too invasive.