chore(deps): switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 (#2453)

Due to reasons documented in
https://github.com/yaml/go-yaml#project-status

The latter is in use anyway, although at v4 rc at the moment. I have not
checked if this one could be upgraded to it while it it.

Co-authored-by: Rex P <106129829+another-rex@users.noreply.github.com>

Author: scop

go.mod

@@ -32,6 +32,7 @@ require (
 	github.com/tidwall/pretty v1.2.1
 	github.com/tidwall/sjson v1.2.5
 	github.com/urfave/cli/v3 v3.6.1
+	go.yaml.in/yaml/v3 v3.0.4
 	go.yaml.in/yaml/v4 v4.0.0-rc.3
 	golang.org/x/net v0.48.0
 	golang.org/x/sync v0.19.0
@@ -41,7 +42,6 @@ require (
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/dnaeon/go-vcr.v4 v4.0.6
 	gopkg.in/ini.v1 v1.67.0
-	gopkg.in/yaml.v3 v3.0.1
 	osv.dev/bindings/go v0.0.0-20260107022749-f5c969937129
 )
 
@@ -202,7 +202,6 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.17.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.46.0 // indirect
 	golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc // indirect
 	golang.org/x/mod v0.30.0 // indirect
@@ -216,6 +215,7 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/libc v1.66.3 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

scripts/generate_mock_resolution_universe/main.go

@@ -41,9 +41,9 @@ import (
 	"github.com/google/osv-scanner/v2/internal/resolution/util"
 	"github.com/google/osv-scanner/v2/internal/version"
 	"github.com/ossf/osv-schema/bindings/go/osvschema"
+	"go.yaml.in/yaml/v3"
 	"golang.org/x/sync/errgroup"
 	"google.golang.org/protobuf/encoding/protojson"
-	"gopkg.in/yaml.v3"
 	"osv.dev/bindings/go/api"
 	"osv.dev/bindings/go/osvdev"
 )