go.{mod,sum}: bump runtime tools, spec deps to v1.3.0.

[klihub]

Bump OCI runtime tools and spec to v1.3.0.

[bart0sh]

/lgtm

[marquiz]

Thanks @klihub

LGTM

[elezar]

Thanks @klihub.

Is this something that we need to "backport" to the v1.0.0 spec, or are the changes on main such that we can go ahead and just release v1.0.1?

[klihub]

Thanks @klihub.

Is this something that we need to "backport" to the v1.0.0 spec, or are the changes on main such that we can go ahead and just release v1.0.1?

@elezar Hmm, I think we don't need to. The only reason for this dependency bump in CDI is to make the necessary OCI Spec bits for the pending Linux net device and RDT monitoring PRs (#269, #292) available to CDI, so we could kick those PRs forward at will.

Even in the (highly theoretical) case that some downstream CDI consumer wanted to make a new release with CDI 1.0.0 and opencontainer/runtime-spec 1.3.0, I'm not sure if we really were forced to do a backport. A locally unresolveable compilation failure would arise downstream if somehow because of us some golang package would be forced in with depending on pre-1.3.0 OCI Spec and someone in the compiled sources would reference LinuxPids.Limit in the Spec. Then we'd hit the int64 vs. *int64 snafu.