deps: bump franz-go to v1.21.0 for Kafka 4.x GSSAPI compatibility

[Ceva]

Summary

Bumps github.com/twmb/franz-go from v1.20.6 to v1.21.0 so kminion can authenticate to Kafka 4.x clusters with SASL/GSSAPI (Kerberos).

Why

Kafka 4.0 (KIP-896) removed the legacy raw-GSSAPI SASL flow. Every SASL session must now start with a SaslHandshakeRequest (KIP-152), including GSSAPI. franz-go v1.20.6 skipped that handshake for GSSAPI and wrote raw tokens straight to the socket, so against a Kafka 4.x broker kminion fails at startup with:

fatal  failed to setup minion service
       failed to create kafka client: failed to test connectivity to Kafka cluster
       failed to request metadata: EOF

Fixed upstream in franz-go e430ea93 ("kgo: send SaslHandshake for GSSAPI mechanism"), released in v1.20.7. v1.21.0 picked here as the latest stable.

Changes

• go.mod: franz-go v1.20.6 → v1.21.0, pkg/kmsg v1.12.0 → v1.13.1
• go.sum: regenerated via go mod tidy
• Minor indirect bumps from go mod tidy (klauspost/compress, pierrec/lz4/v4, x/crypto, x/net, x/sys)

No kminion source code changes.

Reproduce

go get github.com/twmb/franz-go@v1.21.0
go mod tidy
go build ./...
go test ./...

Test plan

Built kminion v2.3.1 with this bump and ran it against a real Kafka 4.1.2 cluster using SASL_SSL + GSSAPI:

Before (v1.20.6): failed to request metadata: EOF at startup.

After (v1.21.0):

info  successfully connected to kafka cluster
debug successfully connected to kafka cluster
      advertised_broker_count=3 topic_count=1749 kafka_version="at least v3.9"

$ curl -s :8080/metrics | grep ^kminion_kafka_cluster_info
kminion_kafka_cluster_info{broker_count="3",cluster_version="at least v3.9",...} 1

go test ./... passes. SASL/PLAIN, SCRAM, OAUTHBEARER, and no-SASL configs are unaffected (they already issued SaslHandshake; this just makes GSSAPI behave the same way).

References

• franz-go fix: twmb/franz-go@e430ea93
• KIP-152 (SASL handshake), KIP-896 (drop legacy raw-GSSAPI in Kafka 4.0)