Crossplane v2.3.5

Changes

• !Dependency security updates: Bumps cel-go (#7761), golang.org/x/mod (#7743), and sigstore-go (#7678), plus a combined set of vulnerable dependency updates (#7650), to pick up upstream CVE fixes. crossplane-runtime is also bumped to v2.3.4 (#7765), which carries its own set of security dependency updates.security
• !Update vulnerable dependencies [security] (release-2.3)security
• !Update module github.com/sigstore/sigstore-go to v1.2.1 [security] (release-2.3)security
• !Update module golang.org/x/mod to v0.40.0 [security] (release-2.3)security
• !Update module github.com/google/cel-go to v0.30.0 [security] (release-2.3)security
• +Correct crank checksums for amd64 binaries (#7666, originally #7660): The published .sha256 files for linux_amd64 binaries had not matched the binaries themselves since v2.2.0, so any install script or Dockerfile that verified the amd64 checksum failed. Checksums are now calculated after Nix strips the binary, and the release workflow verifies them before uploading. Fixes #7467.added
• +Unambiguous Usage index key (#7630, originally #7508): The deletion protection webhook indexed Usage resources by joining API group, kind, name, and namespace with .. Since groups and names can contain . themselves, two distinct resources could collapse to the same key, causing the webhook to block a deletion that should have been allowed. The key now joins with /, which cannot appear in any of those fields.added
• *Pin create-tag to v2 so apis/ submodule tagging works againfixed
• ·Use unambiguous separator for usage index keyother
• ·Backport #7660 to release-2.3other