go.mod: bump the most-deps group across 1 directory with 5 updates

[dependabot]

Bumps the most-deps group with 3 updates in the / directory: github.com/google/cel-go, github.com/zclconf/go-cty and golang.org/x/crypto.

Updates github.com/google/cel-go from 0.27.0 to 0.28.0

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.28.0

High-Level Changes

• Enhanced JSON Interoperability: New support for JSON names across the checker, AST, and runtime allows for more seamless data handling when working with JSON-native structures.
• Improved Developer Tooling: Integration is now smoother thanks to new utilities for converting Go errors into cel.Issues and more descriptive, context-aware error messages.
• Greater Environment Flexibility: You can now redeclare variables as constants and export parse limit options, providing finer control over how CEL environments are configured and constrained.
• Native Struct Improvements: Support for mixing CEL and native values within native structs simplifies the handling of complex, hybrid data types.

---

🚀 Features

• Add helper method to check whether a function has a singleton binding in google/cel-go#1266
• Helper utility for converting a Go error into cel.Issues in google/cel-go#1267
• Policy API improvements in google/cel-go#1268
• CEL Test usability requirements in google/cel-go#1269
• Better context-related error messages in google/cel-go#1271
• Sort env.Config values where reasonable in google/cel-go#1273
• Support redeclaring variables as constants in NewEnv in google/cel-go#1275
• Add support for exporting parse limit options in google/cel-go#1277
• Support mixing CEL values and native values in native structs in google/cel-go#1270
• Add checker, AST, and type-provider support for JSON names in google/cel-go#1283
• JSON field names runtime support in google/cel-go#1286
• Optionally include reachable fieldpaths in prompt in google/cel-go#1285
• REPL -- cel-spec pb2 and json name support google/cel-go#1294

🐞 Bug Fixes

• Fix support for config-based type references in google/cel-go#1265
• Check arg kinds in optional.or and .orValue impl in google/cel-go#1276
• Bazel fixes for import in google/cel-go#1278
• Support zero-value literals in presence test inlining google/cel-go#1280
• Cache concatList.Size() to prevent O(N^2) evaluation time google/cel-go#1291
• Preserve runtime error node IDs from Resolve google/cel-go#1290
• Default enable identifier escaping with backticks google/cel-go#1295
• Cap format string precision to prevent memory exhaustion google/cel-go#1292

🛠️ Maintenance & Internal

• chore: Migrate gsutil usage to gcloud storage in google/cel-go#1274
• Lint fixes for exported function/type comments in google/cel-go#1279
• Lint fixes for import in google/cel-go#1287

---

Full Changelog: https://github.com/google/cel-go/compare/v0.27.0...v0.28.0-alpha

Release v0.28.0-alpha

High-Level Changes

... (truncated)

Commits

• 6b8f6d6 fix: cap format string precision to prevent memory exhaustion (#1292)
• d942970 Default enable identifier escaping with backticks (#1295)
• 7114ed2 Preserve runtime error node IDs from Resolve (#1290)
• d91350b fix: cache concatList.Size() to prevent O(N^2) evaluation time (#1291)
• 68bdd8c REPL -- cel-spec pb2 and json name support (#1294)
• d19e782 Support zero-value literals in presence test inlining and fix shadowing bugs ...
• 7c461fc Lint fixes for import (#1287)
• 09e3119 Optionally include reachable fieldpaths in prompt (#1285)
• ae49cd0 Json field names runtime support (#1286)
• 3624b64 Add checker, ast, and type-provider support for JSON names (#1283)
• Additional commits viewable in compare view

Updates github.com/zclconf/go-cty from 1.18.0 to 1.18.1

Changelog

Sourced from github.com/zclconf/go-cty's changelog.

1.18.1 (April 16, 2026)

• stdlib: ContainsFunc now allows its second argument to be null, to test whether the given collection contains any null elements.
• stdlib: MergeFunc no longer panics if all of its arguments are null values of the same object type with at least one attribute.

Commits

• dcb5db6 v1.18.1
• 77d87c2 stdlib: no MergeFunc crash with null values of object type
• 6854da9 stdlib: ContainsFunc allows testing for presence of null value
• ddb73de Begin development of v1.18.1
• See full diff in compare view

Updates golang.org/x/crypto from 0.49.0 to 0.50.0

Commits

• 03ca0dc go.mod: update golang.org/x dependencies
• 8400f4a ssh: respect signer's algorithm preference in pickSignatureAlgorithm
• 81c6cb3 ssh: swap cbcMinPaddingSize to cbcMinPacketSize to get encLength
• See full diff in compare view

Updates golang.org/x/term from 0.41.0 to 0.42.0

Commits

• 52b71d3 go.mod: update golang.org/x dependencies
• See full diff in compare view

Updates golang.org/x/text from 0.35.0 to 0.36.0

Commits

• 8577a70 go.mod: update golang.org/x dependencies
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions