vendor dockerfile to validate go mod

[crazy-max]

Also adds mod-outdated target:

$ docker buildx bake mod-outdated 

...

#15 [outdated 1/1] RUN --mount=target=.,rw   --mount=target=/go/pkg/mod,type=cache   --mount=from=go-mod-outdated,source=/usr/bin/go-mod-outdated,target=/usr/bin/go-mod-outdated   go list -mod=mod -u -m -json all | go-mod-outdated -update -direct
#15 5.697 +-----------------------------------------+--------------------------------------+-------------+--------+------------------+
#15 5.697 |                 MODULE                  |               VERSION                | NEW VERSION | DIRECT | VALID TIMESTAMPS |
#15 5.697 +-----------------------------------------+--------------------------------------+-------------+--------+------------------+
#15 5.697 | github.com/containerd/containerd/v2     | v2.2.0-rc.0                          | v2.2.1      | true   | true             |
#15 5.697 | github.com/containerd/platforms         | v1.0.0-rc.1                          | v1.0.0-rc.2 | true   | true             |
#15 5.697 | github.com/in-toto/in-toto-golang       | v0.9.0                               | v0.10.0     | true   | true             |
#15 5.697 | github.com/sigstore/sigstore            | v1.10.0                              | v1.10.4     | true   | true             |
#15 5.697 | github.com/sigstore/sigstore-go         | v1.1.4-0.20251124094504-b5fe07a5a7d7 | v1.1.4      | true   | true             |
#15 5.697 | github.com/theupdateframework/go-tuf/v2 | v2.3.0                               | v2.4.1      | true   | true             |
#15 5.697 | golang.org/x/sync                       | v0.18.0                              | v0.19.0     | true   | true             |
#15 5.697 +-----------------------------------------+--------------------------------------+-------------+--------+------------------+
#15 DONE 6.0s