downgrade go-difflib and go-spew to tagged releases

[thaJeztah]

relates to:

• downgrade go-difflib and go-spew to tagged releases #2921
• chore: remove unneeded excludes #3552

This reverts commit 17952c6. This re-applies commit 1ef9e67

Some of the new dependencies reintroduced these;

    go mod graph | grep ' github.com/davecgh/go-spew@v1.1.2'
    github.com/docker/buildx github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc
    github.com/google/certificate-transparency-go@v1.3.2 github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc
    github.com/moby/policy-helpers@v0.0.0-20251206004813-9fcc1a9ec5c9 github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc
    github.com/open-policy-agent/opa@v1.10.1 github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc
    github.com/sigstore/rekor@v1.4.3 github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc
    github.com/sigstore/rekor-tiles/v2@v2.0.1 github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc
    github.com/sigstore/sigstore-go@v1.1.4-0.20251124094504-b5fe07a5a7d7 github.com/davecgh/go-spew@v1.1.2-0.20180830191138-d8f796af33cc

[jsternberg]

@thaJeztah how important is this? The replace areas inside of go.mod prevent installing the module with the go tool and it doesn't seem to me like using the released versions of those two dependencies is all that important. Are they used for anything beyond testing?

[jsternberg]

I'm going to close this because it's been awhile without an answer and I don't think these dependencies are that important to ensure they are on a numbered release when they're only used for tests and it disables the ability to install with the go tool.