ci: Unblock trivy dependency updates

[jpayne3506]

Updates go.opentelemetry.io/otel/sdk/metric from v1.21.0 to v1.27.0 to unblock Trivy updates. This has been blocking all Trivy updates after v0.51.4 as you could not build the patch package. Links below to relevant < workflow | PR >

• v0.54.1 | chore: bump github.com/aquasecurity/trivy from 0.51.4 to 0.54.1 #729
• v0.53.0 | chore: bump github.com/aquasecurity/trivy from 0.51.4 to 0.53.0 #684
• v0.52.2 | chore: bump github.com/aquasecurity/trivy from 0.51.4 to 0.52.2 #666
• v0.52.1 | chore: bump github.com/aquasecurity/trivy from 0.51.4 to 0.52.1 #655
• v0.52.0 | chore: bump github.com/aquasecurity/trivy from 0.51.4 to 0.52.0 #647

RCA of the issue is Trivy using go.opentelemetry.io/otel/metric but not go.opentelemetry.io/otel/sdk/metric. Causing a version mismatch with breaking results within the repo.

Link for release notes:

• https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.27.0.

Notes:

• The only use within copacetic of go.opentelemetry.io/otel/sdk/metric is from

  copacetic/pkg/patch/patch.go

  Line 161 in 10fd0c7

  solveOpt.SourcePolicy, err = build.ReadSourcePolicy()

Closes #729

[jpayne3506]

Also, I leveraged git rebase -i HEAD~4 --signoff to get a signoff on all of my commits as I did not know about the DCO. Perhaps this would be a good addition for https://github.com/project-copacetic/copacetic/blob/main/CONTRIBUTING.md#i-didnt-sign-my-commit-now-what?

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 47.46%. Comparing base (10fd0c7) to head (612e5b8).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #750   +/-   ##
=======================================
  Coverage   47.46%   47.46%           
=======================================
  Files          18       18           
  Lines        1677     1677           
=======================================
  Hits          796      796           
  Misses        826      826           
  Partials       55       55           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[ashnamehrotra]

LGTM, thank you!

[ashnamehrotra]

Also, I leveraged git rebase -i HEAD~4 --signoff to get a signoff on all of my commits as I did not know about the DCO. Perhaps this would be a good addition for https://github.com/project-copacetic/copacetic/blob/main/CONTRIBUTING.md#i-didnt-sign-my-commit-now-what?

yes! I think it would be good to document this