fix: Switch to upstream go-git. Fixes CVE-2023-49569

[terrytangyuan]

This fixes a critical severity vulnerability https://www.cve.org/CVERecord?id=CVE-2023-49569. We cannot use the existing fork anymore. Security is always the highest priority.

✗ Critical severity vulnerability found in github.com/go-git/go-git/v5
  Description: Path Traversal
  Info: https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOGITGOGITV5-6150754
  Introduced through: github.com/go-git/go-git/v5@5.4.7
  From: github.com/go-git/go-git/v5@5.4.7
  Fixed in: 5.11.0

[agilgur5]

We cannot use the existing fork anymore. Security is always the highest priority.

It seems like we were planning on this anyway in #11483 and #11149, in particular since upstream go-git had become maintained again and Argo CD was using upstream as well. I wasn't involved then though, so I don't know the full context.

[agilgur5]

This fixes a critical severity vulnerability https://www.cve.org/CVERecord?id=CVE-2023-49569.

For reference, the details:

Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients

So this only has impact if you have an untrusted Git server. For the principles of zero trust, this is definitely still very important to fix (especially as trusted Git servers can be hacked or supply chain attacked too), but most people will probably not be impacted by this as they use a trusted enterprise vendor