chore(deps): bump retry-go, golangci-lint, govulncheck (#965)

Bumps `github.com/avast/retry-go` v4.7.0 -> v5.0.0, `golangci-lint` v2.11.4 -> v2.12.2 (aligns with gitea/gitea), and pins `govulncheck` to v1.3.0.

- `retry-go` v5 replaces the package-level `retry.Do(fn, opts...)` with a builder API `retry.New(opts...).Do(fn)`. The single call site in `internal/pkg/report/reporter.go` was migrated.
- `golangci-lint` v2.12.2 surfaces three new findings in `act/` (modernize/slicesbackward, govet/inline): one backward loop now uses `slices.Backward`, and the deprecated `reflect.Ptr` alias is replaced with `reflect.Pointer`.
- `go.mod`: the two direct-`require` blocks are merged into one, and a stray `gopkg.in/yaml.v3 // indirect` is moved into the indirect block. Purely cosmetic; `go.sum` is unchanged.

---
This PR was written with the help of Claude Opus 4.7

Reviewed-on: https://gitea.com/gitea/runner/pulls/965
Reviewed-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>

internal/pkg/report/reporter.go

@@ -19,7 +19,7 @@ import (
 
 	runnerv1 "code.gitea.io/actions-proto-go/runner/v1"
 	"connectrpc.com/connect"
-	"github.com/avast/retry-go/v4"
+	"github.com/avast/retry-go/v5"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -433,12 +433,12 @@ func (r *Reporter) Close(lastWords string) error {
 
 	// Report the job outcome even when all log upload retry attempts have been exhausted
 	return errors.Join(
-		retry.Do(func() error {
+		retry.New(retry.Context(r.ctx)).Do(func() error {
 			return r.ReportLog(true)
-		}, retry.Context(r.ctx)),
-		retry.Do(func() error {
+		}),
+		retry.New(retry.Context(r.ctx)).Do(func() error {
 			return r.ReportState(true)
-		}, retry.Context(r.ctx)),
+		}),
 	)
 }