upgrade helm to 3.21.3 and go to 1.26.5, add repository_plain_http attribute

[mlucic]

Description

Upgrade helm to 3.21.3 to remove containerd dependency (associated with CVEs), this also necessitated an upgrade to go 1.26 as well as adding a repository_plain_http attribute due to security patching added to oras-go (sub-dependency of helm 3.21.3, see https://osv.dev/vulnerability/GHSA-vh4v-2xq2-g5cg)

Release Note

Release note for CHANGELOG:

Upgrade Helm from 3.20.2 to 3.21.3

Upgrade `go` from `1.25.8` to `1.26.5`

Add `repository_plain_http` attribute to `helm_release` resource and `helm_template` data source to support plain-HTTP OCI registries, required as of Helm 3.21.3 (via oras-go v2.6.1 per GHSA-vh4v-2xq2-g5cg)

References

https://osv.dev/vulnerability/GHSA-fqw6-gf59-qr4w
https://osv.dev/vulnerability/GHSA-jpcc-p29g-p8mq
https://osv.dev/vulnerability/GHSA-cvxm-645q-p574
https://osv.dev/vulnerability/GHSA-xhf5-7wjv-pqxp
https://osv.dev/vulnerability/GHSA-rgh6-rfwx-v388
https://osv.dev/vulnerability/GHSA-33vj-92qq-66hc
https://osv.dev/vulnerability/GHSA-vh4v-2xq2-g5cg

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment