chore: update dependencies due to CVE-2023-1732

[carslen]

Previous used dep github.com/cloudflare/circl had a security issue (CVE-2023-1732). Updated the go dependencies to get new version.

Fixes CVE-2023-1732

Pre-review checks

Please ensure to do as many of the following checks as possible, before asking for committer review:

• DEPENDENCIES are up to date. Dash license tool. Committers can open IP issues for restricted libs.
• Copyright and license header are present on all affected files

[FaGru3n]

LGTM

[SebastianBezold]

There are restricted dependencies included, we need to make sure, that we let them be approved, before creating a release version with it, or wait, until we can update the DEPENDENCIES here in the PR

[carslen]

There are restricted dependencies included, we need to make sure, that we let them be approved, before creating a release version with it, or wait, until we can update the DEPENDENCIES here in the PR

It's a trade-off between fixing a high scurity finding in a dependency and matching the EF rules. The IP-Check for the last 2 restricted dependencies has been opened (there were even more yesterday, but automatically approved by Dash bot), but needs manual IP team assistance.

[SebastianBezold]

There are restricted dependencies included, we need to make sure, that we let them be approved, before creating a release version with it, or wait, until we can update the DEPENDENCIES here in the PR

It's a trade-off between fixing a high scurity finding in a dependency and matching the EF rules. The IP-Check for the last 2 restricted dependencies has been opened (there were even more yesterday, but automatically approved by Dash bot), but needs manual IP team assistance.

Yes I also think it will always be a trade-off. i think to evaluate the criticality, we would also need to know, where (and if) we are using this dependency actively. Meaning, if the vulnerability can be exploited. Do we know how this is used in our quality checks?

[carslen]

Updated DEPENDENCIES file, no more restricted entries available @SebastianBezold