Bump patch-level dependencies while leaving
packageurl-go unchanged. This updates AWS config/credentials,
smithy-go, klauspost/compress, and sigstore-go, with required
companion bumps from their module constraints.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>