Bump github.com/go-jose/go-jose to v3.0.3 to fix CVE-2024-28180

[wallrj]

This should fix the failing trivy tests in test grid which are reporting that cert-manager controller is vulnerable to https://avd.aquasec.com/nvd/2024/cve-2024-28180/:

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

• https://testgrid.k8s.io/cert-manager-periodics-master#ci-cert-manager-master-trivy-test-controller
• https://prow.build-infra.jetstack.net/view/gs/jetstack-logs/logs/ci-cert-manager-master-trivy-test-controller/1768032000838471680
• https://github.com/cert-manager/cert-manager/security/dependabot/89
• https://github.com/cert-manager/cert-manager/security/dependabot/88

We think this is a false positive, because the cert-manager controller does not handle JWE.
and because govulncheck reports that the controller is not vulnerable to this issue:

$ make go-workspace
go work init
go work use . ./cmd/acmesolver ./cmd/cainjector ./cmd/controller ./cmd/startupapicheck ./cmd/webhook ./test/integration ./test/e2e

$ GOTOOLCHAIN=go1.22.1 govulncheck -show verbose ./...
Scanning your code and 1508 packages across 160 dependent modules for known vulnerabilities...

No vulnerabilities found.

Nevertheless, we are updating the module for the sake of silencing the trivy alerts in our repo and of any of our users.

I ran the following commands to update the go-jose module:

find . -name go.mod -execdir go get github.com/go-jose/go-jose/v3@v3.0.3 \; 
make tidy

/kind cleanup

Bump github.com/go-jose/go-jose to v3.0.3 to fix CVE-2024-28180

[inteon]

/approve
/lgtm

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment