Merge pull request #1456 from rawlingsj/melange_bump3

bump melange v0.21.0 to pick up annotations

Author: rawlingsj

Diff for: go.mod

@@ -15,7 +15,7 @@ replace golang.org/x/vuln => github.com/chainguard-dev/golang-vuln v1.1.3
 
 require (
 	chainguard.dev/apko v0.25.1
-	chainguard.dev/melange v0.20.1
+	chainguard.dev/melange v0.21.0
 	cloud.google.com/go/storage v1.50.0
 	github.com/adrg/xdg v0.5.3
 	github.com/anchore/grype v0.87.1-0.20250128180623-27bcc7a9e9e8 // tracking main/27bcc7a9e9e8 until https://github.com/anchore/grype/pull/2397 is released

Diff for: go.sum

@@ -4,8 +4,8 @@ chainguard.dev/apko v0.25.1 h1:QgjABgcg5pKwRyF7A1gfx48M10lDiC0L9Xugv3jlV98=
 chainguard.dev/apko v0.25.1/go.mod h1:IjtI+nKxNalF5ysiz36wM2Au66Lv9YDXdF0LJWXYIR0=
 chainguard.dev/go-grpc-kit v0.17.7 h1:TqHua7er5k8m6WM96y0Tm7IoLLkuZ5vh3+5SR1gruKg=
 chainguard.dev/go-grpc-kit v0.17.7/go.mod h1:JroMzTY9mdhKe/bvtyChgfECaNh80+bMZH3HS+TGXHw=
-chainguard.dev/melange v0.20.1 h1:zBszPqIp8cNpDp6InxMMDZqNpgfsfJXyaOJ5qbNfBIY=
-chainguard.dev/melange v0.20.1/go.mod h1:h2rMx0umpzAhJ+VmORnBNWo13VLcQyDYdse7Mr3XBeY=
+chainguard.dev/melange v0.21.0 h1:iRtIi6XB3PWJkhupMcZ6g/rOZGCJ7oUQwJFEWcst+SA=
+chainguard.dev/melange v0.21.0/go.mod h1:h2rMx0umpzAhJ+VmORnBNWo13VLcQyDYdse7Mr3XBeY=
 chainguard.dev/sdk v0.1.31 h1:Blvpa0Ji/tC1VVV8/l8UyQe022LoRxZLfgasyFE1EhQ=
 chainguard.dev/sdk v0.1.31/go.mod h1:/zqikqbDCBAAlhIDuBl8V4bR9nmB1qLEIn2w9FxzNwI=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=