feat: deprecate --experimental- flags in favor of shorter --x- versions - #2589

osv-scanner 2.7.0 adds --x- aliases for the experimental flags and
deprecates the --experimental- spellings (google/osv-scanner#2589). The
source scans run osv-scanner-action v2.7.0, whose image ships 2.7.0, so
the alias is available to both jobs.

osv-scanner 2.7.0 adds --x- aliases for the experimental flags and
deprecates the --experimental- spellings (google/osv-scanner#2589). The
source scans run osv-scanner-action v2.7.0, whose image ships 2.7.0, so
the alias is available to both jobs.

osv-scanner 2.7.0 adds --x- aliases for the experimental flags and
deprecates the --experimental- spellings (google/osv-scanner#2589). The
source scans run osv-scanner-action v2.7.0, whose image ships 2.7.0, so
the alias is available to both jobs.

* chore(deps): update dependency pinact to v5.0.2

* chore(deps): update dependency buf to v1.75.0

* chore(deps): update dependency gh to v2.103.3

* chore(deps): update dependency golangci-lint to v2.15.0

* chore(deps): update uv to v0.13.6

* chore(deps): update dependency github:pressly/goose to v3.29.0

* chore(deps): update dependency osv-scanner to v2.7.0

* chore(deps): update github actions

* fix(deps): update dependency zensical to v0.0.74

* chore(deps): update dependency playwright to v1.64.1

* fix(deps): update dependency pytest to v9.2.0

* fix(deps): update module github.com/pressly/goose/v3 to v3.29.0

api and observability-proxy run their migrations through the goose
library, and mise pins the goose CLI that db:migrate and the e2e runner
use against the same api/migrations. Move the library to the version
the CLI moved to so both apply migrations with the same release.

v3.29.0 adds YDB environment credentials and upgrades dependencies;
nothing in it changes the Postgres or ClickHouse providers. The go get
raises the indirect requirements goose needs, among them grpc 1.84.0 and
golang.org/x/mod 0.42.0 in api.

* ci(osv): pass --x-exclude instead of the deprecated flag

osv-scanner 2.7.0 adds --x- aliases for the experimental flags and
deprecates the --experimental- spellings (google/osv-scanner#2589). The
source scans run osv-scanner-action v2.7.0, whose image ships 2.7.0, so
the alias is available to both jobs.

* chore(renovate): strip the v prefix from github: backend tool tags

The goose update (#1128) wrote "github:pressly/goose" = "v3.29.0" into
mise.toml and specifiers = ["v3.29.0"] into mise.lock, where every other
pin is a bare version; the controller-tools update (#1127) does the same.
Renovate's lookup gives newValue 3.29.0 but newVersion v3.29.0, the raw
release tag, and the mise lock it runs for the lockfile rewrites the
request in mise.toml to that tag.

extractVersion already handled this for infisical. Apply it to every
github: backend tool too; a renovate --platform=local --dry-run=lookup
now reports newVersion 3.29.0 for goose and 0.23.0 for controller-tools.
matchDepNames takes a regex here because a "github:**" glob does not
cross the slash in owner/repo. The optional v keeps a tool whose tags
have no prefix from losing every release.