fix(deps): Bump runc replace pin from v1.2.8 to v1.3.6

[kgeckhart]

Brief description of Pull Request

Bump the runc replace pin from v1.2.8 to v1.3.6 for security fixes

Pull Request Details

The replace directive pinned the effective build to v1.2.8 regardless of the require line, so #6577, #6578, and #6579 — which bump only require — change nothing that ships; this supersedes all three. The original pin existed because runc v1.3.x moved libcontainer/cgroups into a separate module the old cadvisor build needed; the grafana/cadvisor fork migrated to opencontainers/cgroups in #5447, so the pin now only needs to stay below v1.4.0, which removes libcontainer/user that dockertest still imports.

[github-actions]

🔍 Dependency Review

github.com/opencontainers/runc v1.2.8 → v1.3.6 (and root module v1.3.3 → v1.3.6) — ✅ Safe

Scope

• All modules pin/replace github.com/opencontainers/runc to v1.3.6 (collector, extension/alloyengine, root).
• Net effect:
  • Previously: replace to v1.2.8 in submodules and v1.3.3 (indirect) in root.
  • Now: consistently v1.3.6 across the repo.

What changed (changelog highlights to review)

• Review window: v1.2.8 → v1.3.6 (includes all 1.2.x patches after 1.2.8, 1.3.0, and 1.3.x patches).
• No removals of the internal libcontainer packages used by downstreams (e.g., libcontainer/user, libcontainer/cgroups) occur until v1.4.0. Your updated pin explicitly avoids v1.4.0 for the reason noted in the PR comment.
• 1.3.x series contains bug fixes, security hardening, and minor improvements; no changelog entries indicate breaking API changes for libcontainer packages in this range.

References

• Releases: https://github.com/opencontainers/runc/releases
• Changelog: https://github.com/opencontainers/runc/blob/main/CHANGELOG.md

Impact assessment

• This repository does not import runc as a public API; it’s an indirect dependency and/or relied upon for internal libcontainer packages by transitive deps (e.g., cadvisor, dockertest).
• The explicit requirement to “stay below v1.4.0” is respected (v1.3.6 retains libcontainer/user).
• No code changes are required in this repository for v1.2.8 → v1.3.6 (or v1.3.3 → v1.3.6 in root), based on the above scope and changelog review.

Recommended checks (non-blocking)

• If you vendor or rely on tests that import libcontainer/user (e.g., via dockertest), keep the pin below v1.4.0 until that upstream drops/updates those imports.
• If/when you consider moving to ≥ v1.4.0, you will need to ensure no transitive import relies on libcontainer/user; that will require upstream updates.

Code changes required

• None.

github.com/opencontainers/selinux v1.13.0 → v1.13.1 — ✅ Safe

Scope

• Indirect dependency bump in root, collector, and extension/alloyengine modules.

What changed (changelog highlights to review)

• Patch release with minor fixes; no API-breaking changes are documented for v1.13.1.

References

• Releases: https://github.com/opencontainers/selinux/releases
• Changelog: https://github.com/opencontainers/selinux/blob/master/CHANGELOG.md

Impact assessment

• The project does not import this package directly; it’s pulled in by transitive dependencies that handle SELinux labels/contexts.
• No API changes to address.

Code changes required

• None.

Notes

• The replace directive for github.com/opencontainers/runc now pins v1.3.6 with the explicit intent to remain below v1.4.0, where libcontainer/user is removed. If/when you consider moving to ≥ v1.4.0, ensure all transitive dependencies (e.g., dockertest, cadvisor) have dropped imports of libcontainer/user before unpinning.