[release/1.7 backport] vendor: google.golang.org/protobuf 1.33.0, github.com/golang/protobuf v1.5.4

[thaJeztah]

backport of:

• build(deps): bump google.golang.org/protobuf from 1.31.0 to 1.32.0 #9578
• build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0 #9958
• vendor: github.com/golang/protobuf v1.5.4 #9967

Updating the version to verify compatibility, and to prevent possible incompatiblities if consumers of containerd have to update these, but containerd itself is still on an older version (moby/buildkit#4773 (comment)).

These updates keep the scanners at bay for CVE-2024-24786 / GO-2024-2611, although containerd itself is not affected;

This scan also found 2 vulnerabilities in packages you import and 0 vulnerabilities in modules you require, but your code doesn't appear to call these vulnerabilities.

govulncheck -show=verbose ./...
Scanning your code and 616 packages across 117 dependent modules for known vulnerabilities...

=== Symbol Results ===

No vulnerabilities found.

=== Package Results ===

Vulnerability #1: GO-2024-2631
    Decompression bomb vulnerability in github.com/go-jose/go-jose
  More info: https://pkg.go.dev/vuln/GO-2024-2631
  Module: gopkg.in/square/go-jose.v2
    Found in: gopkg.in/square/go-jose.v2@v2.5.1
    Fixed in: N/A

Vulnerability #2: GO-2024-2611
    Infinite loop in JSON unmarshaling in google.golang.org/protobuf
  More info: https://pkg.go.dev/vuln/GO-2024-2611
  Module: google.golang.org/protobuf
    Found in: google.golang.org/protobuf@v1.31.0
    Fixed in: google.golang.org/protobuf@v1.33.0

=== Module Results ===

Vulnerability #1: GO-2023-2402
    Man-in-the-middle attacker can compromise integrity of secure channel in
    golang.org/x/crypto
  More info: https://pkg.go.dev/vuln/GO-2023-2402
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.14.0
    Fixed in: golang.org/x/crypto@v0.17.0

Your code is affected by 0 vulnerabilities.
This scan also found 2 vulnerabilities in packages you import and 1
vulnerability in modules you require, but your code doesn't appear to call these
vulnerabilities.