fix CVE for tink-worker

[andy-vm]

Merge Checklist

All boxes should be checked before merging the PR

• The changes in the PR have been built and tested
• cgmanifest file has been updated if required
• Ready to merge

Description

upgrade tink worker for CVE fix
https://jira.devtools.intel.com/browse/ITEP-81743

Any Newly Introduced Dependencies

How Has This Been Tested?

tested by Piyush

[aaroncyew]

Automated Messages: Label 'tink-worker' has been added to this Pull Request.

[aaroncyew]

+1
this PR only resolves Go module github.com/opencontainers/selinux CVE-2025-52881

there are other CVE's detected for x-crypto and containerd2, and mark for label.
this was tested in
buildID: 1344
scanID: 7978868

[andy-vm]

+1 this PR only resolves Go module github.com/opencontainers/selinux CVE-2025-52881

there are other CVE's detected for x-crypto and containerd2, and mark for label. this was tested in buildID: 1344 scanID: 7978868

this PR fixed all reported CVEs in tink-worker, see scan result https://bdba001.icloud.intel.com/#/product/7979383/analysis
other CVEs are false positive

[aaroncyew]

+1 this PR only resolves Go module github.com/opencontainers/selinux CVE-2025-52881
there are other CVE's detected for x-crypto and containerd2, and mark for label. this was tested in buildID: 1344 scanID: 7978868

this PR fixed all reported CVEs in tink-worker, see scan result https://bdba001.icloud.intel.com/#/product/7979383/analysis other CVEs are false positive

update all the required components matching the new release tink-worker .yaml, as this may cause false positives on the analysis scan results.

[andy-vm]

+1 this PR only resolves Go module github.com/opencontainers/selinux CVE-2025-52881
there are other CVE's detected for x-crypto and containerd2, and mark for label. this was tested in buildID: 1344 scanID: 7978868

this PR fixed all reported CVEs in tink-worker, see scan result https://bdba001.icloud.intel.com/#/product/7979383/analysis other CVEs are false positive

update all the required components matching the new release tink-worker .yaml, as this may cause false positives on the analysis scan results.

one false positive is about Rust, we are not using it
the other 2 are reporting CVEs in 1.7.27, but we already upgraded to 1.7.29