Update module oras.land/oras-go/v2 to v2.6.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
oras.land/oras-go/v2	v2.6.3 → v2.6.4

---

Release Notes

oras-project/oras-go (oras.land/oras-go/v2)

v2.6.4

Compare Source

This is a patch release with security fixes to the file store and auth client, and bug fixes to the file store, OCI store, and retry layers since v2.6.3.

Security Fixes

• Remove a symlink at the target path before writing in the file store's pushFile and pushDir, and open files with O_NOFOLLOW on unix, so a pushed blob can no longer be written through a planted terminal symlink to a file outside the store root (GHSA-2hhj-vj64-hx3j)
• Skip restoring times and mode on symlinks during tar extraction, and replace a symlink at a directory entry's path with a real directory, so a crafted unpack layer can no longer change the timestamps or permissions of files outside the store root (GHSA-jh75-xv39-vhvx)
• Compare each redirect hop against the first request in auth.Client, so a second same-origin hop on the redirect target no longer restores the Authorization header removed by the GHSA-vh4v-2xq2-g5cg guard, and refuse to resend an OAuth2 token request body (password or refresh token) to another origin on a 307 or 308 (GHSA-xc97-9f2f-9hrx)
• Resolve non-literal bearer realm hosts and reject realms resolving to loopback, link-local, private, unspecified, or carrier-grade NAT addresses, and re-validate every redirect hop of distribution and OAuth2 token requests, so a realm such as localhost or a DNS name pointing at an internal address no longer bypasses validateRealm (GHSA-mm27-wq9c-mxxr)

Bug Fixes

• Resolve tar hard link targets from the archive root rather than the link's directory, so a hard link whose target sits in another directory extracts instead of failing with "no such file or directory" (#​1510, #​1572)
• Skip digest-named directories under blobs/<alg>/ during OCI store GC, which previously aborted on a non-empty directory; os.Remove errors now include the blob path (#​1526, #​1579, #​1588)
• Retry on connection reset by peer and unexpected EOF in retry.DefaultPredicate, so a single reset from a registry no longer fails the whole operation (#​1567, #​1570)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.