pin Go version to 1.20.5

[tonistiigi]

Go 1.20.6 broke many tools (eg. Buildx). Better to be on the safe side and pin 1.20.5 until the full extent is determined/resolved.

[tonistiigi]

I tested that buildctl with unix:// address seems to work fine. And container connhelper does direct docker exec https://github.com/moby/buildkit/blob/master/client/connhelper/dockercontainer/dockercontainer.go#L32 instead of using Docker client. So we might be fine.

Refs:
moby/moby#45935
https://github.com/moby/moby/pull/45942/files
golang/go#61076

The downside of pinning would be that some security scanner could pick up the new release as vulnerable from the start.

[tonistiigi]

With further investigation, we haven't found a case that is breaking. Looks like HTTP2 part of the patch was not backported and we don't create HTTP1 connections over Unix sockets.