Do not transitively uplift dependencies in the update bot

[bszirtes]

Problem

The dependent-repository update bot upgrades unrelated third-party
dependencies as a side effect of bumping an NSM module, with no signal in the
PR title. This just broke integration-k8s-kind CI for days.

What happened:

1. vpphelper merged 77eb5fca, which changed only .golangci.yml and
   .github/workflows/ci.yaml. Its go.mod was untouched and it still requires
   go.fd.io/govpp v0.11.0.

2. That push fanned out here, and this workflow ran
   go get -u github.com/networkservicemesh/vpphelper@main in cmd-forwarder-vpp.

3. The resulting PR, titled "Update from update/networkservicemesh/vpphelper",
   bumped six dependencies, including go.fd.io/govpp v0.11.0 -> v0.13.0:

   -	github.com/networkservicemesh/vpphelper v0.0.0-20250204173511-c366e1dc63af
   +	github.com/networkservicemesh/vpphelper v0.0.0-20260903100955-77eb5fca7764
   -	github.com/sirupsen/logrus v1.9.4
   +	github.com/sirupsen/logrus v1.10.2
   -	github.com/stretchr/testify v1.11.1
   +	github.com/stretchr/testify v1.12.1
   -	go.fd.io/govpp v0.11.0
   +	go.fd.io/govpp v0.13.0
   -	github.com/fsnotify/fsnotify v1.8.0 // indirect
   +	github.com/fsnotify/fsnotify v1.10.1 // indirect
   -	golang.org/x/sys v0.46.0 // indirect
   +	golang.org/x/sys v0.47.0 // indirect

4. govpp v0.13.0 carries a regression in subscriptionCtx.Unsubscribe() that
   leaves a closed notification channel in Connection.subscriptions, so the
   next notification panics with send on closed channel. Every VPP component
   crashlooped, and the automerged PR made it look like an NSM change.

Nothing in the dependency graph required v0.13.0: vpphelper and
networkservicemesh/govpp require v0.11.0, sdk-vpp requires v0.10.0-alpha.
The uplift came purely from -u.

Why -u does this

-u upgrades the dependency closure of the packages named on the command
line, not just the named module. vpphelper has a root-level Go package, so
its entire closure was upgraded. sdk, sdk-vpp and sdk-kernel keep their
code under pkg/, so go get -u <them>@main names no package and produces only
a single-line module bump - which is why sdk-* updates never showed this
behaviour and this went unnoticed until a root-package base repo was touched.

Change

Drop -u, so the bot moves only the module it is supposed to move:

-GOPRIVATE=github.com/networkservicemesh go get -u github.com/${base_repository}@main
+GOPRIVATE=github.com/networkservicemesh go get github.com/${base_repository}@main
 go mod tidy

go get M@main still resolves main to the latest pseudo-version and updates
the requirement, and still raises any dependency the new version genuinely
requires (MVS). It just stops volunteering unrelated upgrades. go mod tidy is
unchanged.

Trade-off (please review)

With -u, these PRs doubled as a de facto "refresh all dependencies" job. After
this change, third-party dependencies advance only when something requires them
or Dependabot bumps them.

Dependabot coverage is not uniform today - e.g. sdk and
integration-k8s-kind have .github/dependabot.yml, while cmd-forwarder-vpp
and cmd-nsmgr do not. If we want to keep dependencies moving, the follow-up is
to add Dependabot to the repos that lack it, where bumps arrive as separate,
reviewable, correctly-titled PRs instead of hiding inside an NSM module bump.

Related occurrences (not changed here)

-u is used in two other shared workflows with the same failure mode. Left out
of this PR to keep it reviewable, but worth deciding on:

• .github/workflows/resolve-conflicts.yaml:58 -
  go get -u github.com/networkservicemesh/${repository}@main (same operation as
  this workflow, so arguably should match)
• .github/workflows/release-dependent-repositories.yaml:64 -
  go get -u $dep@${tag}, which can transitively uplift third-party deps during
  a release

Fallout being cleaned up

• Pin go.fd.io/govpp to v0.11.0 to avoid Unsubscribe regression cmd-forwarder-vpp#1359 (merged) - pinned govpp back to
  v0.11.0. Basic suite went 6P/8F -> 14P/0F, Ipsec 0P/6F -> 6P/0F, and the
  afxdp / ipv6 / heal-extended jobs went green.
• Same pin opened for the other affected components: cmd-nse-vl3-vpp#441,
  cmd-nsc-vpp#798, cmd-nse-firewall-vpp#615, cmd-nse-vlan-vpp#630,
  cmd-nse-icmp-responder-vpp#782, cmd-nse-simple-vl3-docker#343,
  cmd-nsc-simple-docker#329.
• The govpp Unsubscribe() regression is still present on govpp master and
  needs an upstream fix; one line - store the shrunk slice back into
  conn.subscriptions[msgID].