fix(ops): allow gmpctl to ignore specified modules; loop

[bwplotka]

This PR improves gmpctl vulnfix reliability by adding module ignoring capabilities, fixing dependency parsing, and adding multi-pass vulnerability resolution.

Changes Included

1. Ignored Modules Support:

   • Added vuln_ignored_modules setting in .gmpctl.default.yaml.
   • Added -vuln-ignore-modules flag to gmpctl and vulnupdatelist to skip specific Go module upgrades (such as github.com/prometheus/prometheus) during vulnerability remediation.

2. Dependency Update Bug Fix (lib.sh):

   • Fixed release-lib::gomod_vulnfix parsing of vulnupdatelist output (using $1 instead of $2 to correctly extract module@version rather than CVE IDs).
   • Switched from line-matching sed to go get "${mod_path}@${desired_version}" to reliably update both direct and indirect dependencies in go.mod.

3. Multi-Pass Vulnerability Resolution (vulnfix.sh):

   • Added an iterative loop (up to 5 attempts) in vulnfix.sh to handle chained/transitive vulnerability fixes (e.g., when updating a module reveals a higher patch requirement in subsequent scans).

4. Tests:

   • Added unit tests in vulnupdatelist/vuln_test.go verifying ignored module logic and update list compilation.

[gemini-code-assist]

Code Review

This pull request introduces the ability to ignore specific Go modules during dependency upgrades by adding an ignored_modules configuration option to gmpctl. The feedback suggests optimizing the module lookup by using a map instead of a slice to achieve O(1) complexity, which requires updating the parsing logic, the signature of compileUpdateList, and the unit tests. Additionally, it is recommended to make the unit test hermetic by avoiding external NVD API calls triggered by osv entries in the mock JSON.