feat: support ignore-vulnerabilities in rock oci publish workflow (#142)

## Description

This PR updates the reusable rock OCI publishing workflow
(`.github/workflows/_rock-oci-publish.yaml`) to support passing ignored
vulnerabilities when triggering builds/releases via the `oci-factory`
CLI.

### Changes
- **Workflow input**: Added optional `ignore-vulnerabilities` string
input (defaults to `""`) to accept a comma-separated list of
vulnerability/CVE IDs to ignore.
- **CLI argument formatting**: Formats and passes
`--ignored-vulnerabilities=<ids>` to `oci-factory upload` commands for
both stable and edge/candidate releases when specified. Whitespace is
stripped to prevent shell argument splitting issues.
- **Go version compatibility**: Updated `setup-go` version requirement
from `>=1.22.0` to `>=1.25.0` to ensure compatibility with
`github.com/canonical/oci-factory/tools/cli-client` which requires Go
1.25+.

Ref:
canonical/oci-factory#1182 (comment)

Author: shipperizer

.github/workflows/_rock-oci-publish.yaml

@@ -31,6 +31,11 @@ on:
         type: string
         required: false
         default: "22.04"
+      ignore-vulnerabilities:
+        type: string
+        required: false
+        default: ""
+        description: "Comma-separated list of vulnerabilities to ignore"
 
 jobs:
   oci-factory:
@@ -41,7 +46,7 @@ jobs:
       - name: Golang setup
         uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
-          go-version: ">=1.22.0"
+          go-version: ">=1.25.0"
       # install oci-factory via golang and set path in environment
       - name: Install oci-factory
         run: |
@@ -56,13 +61,18 @@ jobs:
           echo EOL_CANDIDATE=$(date -d "$(date +'%Y-%m-%d') +${{ inputs.eol-edge-release }}" "+%Y-%m-%d") >> $GITHUB_ENV
           echo IMAGE_VERSION_STABLE=$($YQ '.version | split(".").0' rockcraft.yaml) >> $GITHUB_ENV
           echo IMAGE_VERSION_CANDIDATE=$($YQ '.version | split(".").[0:2] | join(".")' rockcraft.yaml) >> $GITHUB_ENV
+          IGNORE_VULNS="${{ inputs.ignore-vulnerabilities }}"
+          IGNORE_VULNS="$(echo "$IGNORE_VULNS" | tr -d ' ')"
+          if [ -n "$IGNORE_VULNS" ]; then
+            echo "IGNORED_VULNERABILITIES=--ignored-vulnerabilities=$IGNORE_VULNS" >> $GITHUB_ENV
+          fi
       - name: Release to stable
-        run: $OCI_FACTORY upload -y --release track=$IMAGE_VERSION_STABLE-${{ inputs.ubuntu-base-version }},risks=stable,eol=$EOL_STABLE
+        run: $OCI_FACTORY upload -y --release track=$IMAGE_VERSION_STABLE-${{ inputs.ubuntu-base-version }},risks=stable,eol=$EOL_STABLE $IGNORED_VULNERABILITIES
         if: inputs.stable-release == true
         env:
           GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }}
       - name: Release to edge and candidate
-        run: $OCI_FACTORY upload -y --release track=$IMAGE_VERSION_CANDIDATE-${{ inputs.ubuntu-base-version }},risks=candidate,edge,eol=$EOL_CANDIDATE
+        run: $OCI_FACTORY upload -y --release track=$IMAGE_VERSION_CANDIDATE-${{ inputs.ubuntu-base-version }},risks=candidate,edge,eol=$EOL_CANDIDATE $IGNORED_VULNERABILITIES
         if: inputs.edge-release == true
         env:
           GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }}