kubevela/1.9.13-r1: cve remediation (#35699)

The automation almost got this one right, but it omitted '+incompatible'
(internal DYDX issue filed).

-------

kubevela/1.9.13-r1: fix GHSA-gh5c-3h97-2f3q

Advisory data:
https://github.com/wolfi-dev/advisories/blob/main/kubevela.advisories.yaml

---------

Signed-off-by: Mark McCormick <[email protected]>
Co-authored-by: octo-sts[bot] <[email protected]>
Co-authored-by: Mark McCormick <[email protected]>

kubevela.yaml

@@ -1,7 +1,7 @@
 package:
   name: kubevela
   version: 1.9.13
-  epoch: 1
+  epoch: 2
   description: KubeVela is a modern application delivery platform that makes deploying and operating applications across today's hybrid, multi-cloud environments easier, faster and more reliable
   copyright:
     - license: Apache-2.0
@@ -31,8 +31,8 @@ pipeline:
 
   - uses: go/bump
     with:
-      deps: github.com/containerd/[email protected] github.com/cloudflare/[email protected] go.opentelemetry.io/contrib/instrumentation/net/http/[email protected] go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/[email protected] go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected] github.com/fluxcd/source-controller/[email protected] oras.land/[email protected] golang.org/x/[email protected] github.com/hashicorp/[email protected]
-      replaces: github.com/go-git/go-git/v5=github.com/go-git/go-git/[email protected] github.com/docker/docker=github.com/moby/moby@v24.0.9+incompatible
+      deps: github.com/containerd/[email protected] github.com/cloudflare/[email protected] go.opentelemetry.io/contrib/instrumentation/net/http/[email protected] go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/[email protected] go.opentelemetry.io/otel/exporters/otlp/otlptrace/[email protected] github.com/fluxcd/source-controller/[email protected] oras.land/[email protected] golang.org/x/[email protected] github.com/hashicorp/[email protected] github.com/moby/[email protected]
+      replaces: github.com/go-git/go-git/v5=github.com/go-git/go-git/[email protected] github.com/docker/docker=github.com/moby/moby@v26.1.0+incompatible
 
   - uses: go/build
     with: