fix(deps): Bump oras-go to v2.6.2 and golang.org/x/sync to v0.22.0

[maciaszczykm]

Fixes PROD-5041.

[greptile-apps]

Greptile Summary

This PR bumps two indirect Go dependencies: oras.land/oras-go/v2 from v2.6.1 to v2.6.2 and golang.org/x/sync from v0.21.0 to v0.22.0. Both go.mod and go.sum are updated consistently with the correct new hashes.

• oras.land/oras-go/v2 v2.6.2 — patch release of the OCI Registry As Storage client library; marked indirect.
• golang.org/x/sync v0.22.0 — minor release of the Go extended sync package; marked indirect.
• go.sum correctly removes the old checksums and adds the new ones for both packages.

Confidence Score: 5/5

Safe to merge — both dependencies are indirect, the version bumps are small, and go.sum is consistent with go.mod.

Both updated packages are indirect dependencies used through other libraries, not directly invoked by application code. The go.sum checksums are correctly updated to match the new versions, with no mismatches or stale entries.

No files require special attention.

Important Files Changed

Filename	Overview
go.mod	Bumps oras.land/oras-go/v2 from v2.6.1 to v2.6.2 and golang.org/x/sync from v0.21.0 to v0.22.0 — both are indirect dependencies.
go.sum	Hash entries for both updated dependencies are correctly replaced; old hashes removed and new hashes added consistently.

_{Reviews (1): Last reviewed commit: "fix(deps): bump oras-go to v2.6.2 and go..." | Re-trigger Greptile}

[linear]

PROD-5041