Crossplane v2.2.4

Changes

• !Vulnerability-scannable images (#7575): Container images are now built with buildGoModule (replacing gomod2nix), so published images can be scanned by standard vulnerability tooling.security
• !Dependency security updates: Bumps grpc / golang.org/x/net / golang.org/x/text (#7619) and the sigstore stack — cosign (#7558), rekor (#7557), timestamp-authority (#7569), sigstore-go (#7582) — to pick up upstream CVE fixes. See ## What's Changed for the full list.security
• !Update module github.com/sigstore/rekor to v1.5.2 [security] (release-2.2)security
• !Update module github.com/sigstore/cosign/v3 to v3.0.6 [security] (release-2.2)security
• !Update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.2)security
• !Build with buildGoModule so images are vulnerability-scannablesecurity
• !Update module github.com/sigstore/sigstore-go to v1.2.0 [security] (release-2.2)security
• !Combined security bumps (grpc, x/net, x/text) (release-2.2)security
• +Fixed repeated owner updates for composed Usages (#7596, originally #7591): The Usage controller only checked the first ownerReference when deciding whether the spec.by resource already owned the Usage. A Usage created by a Composition already has the composite as its first owner, so spec.by ended up as a later owner and the controller issued an unnecessary update on every reconciliation — repeatedly re-triggering composition reconciliation and eventually opening the XR circuit breaker. It now checks all owner references.added
• *Avoid repeated owner updates for composed Usagesfixed