Add big-fat-warning re: golang 1.21+ toolchain

[cevich]

In addition to some much needed config. file maintenance:

  // *****  ATTENTION  WARNING  CAUTION  DANGER  ***** //
  // Go versions 1.21 and later will AUTO-UPDATE based on _module_
  // _requirements_.  ref: https://go.dev/doc/toolchain  Because
  // many different projects covered by this config, build under
  // different distros and distro-versions, golang version consistency
  // is desireable across build outputs.  In golang 1.21 and later,
  // it's possible to pin the version in each project using the
  // toolchain go.mod directive.  Prior to 1.21, for now, we do not
  // want Renovate to propose updates which also trigger golang
  // auto-updates. The only way to fully disable these auto-updates
  // in renovate is through a forced static-version constraint. This
  // is undesireable from a maintenance perspective, and hopefully
  // temporarry. Ref: Upstream discussion https://github.com/golang/go/issues/65847

/cc @mtrmac

[github-actions]

Successfully triggered github-actions/success task to indicate successful run of cirrus-ci_retrospective integration and unit testing from this PR's e16a5c5e8a0ecd89c85279fd48ee88265f9bfb4c.

[mtrmac]

I don’t know that I have any specific expertise here — I agree with the intent, and the mechanism of all the changes looks plausible (but I didn’t, so far, validate them line by line against Renovate’s documentation).

LGTM I guess?

[mtrmac]

Ref. upstream discussion: golang/go#65847

[cevich]

@mtrmac @Luap99 PTAL, Updated the PR description w/ new comment content, does this read better/okay now?

[github-actions]

Successfully triggered github-actions/success task to indicate successful run of cirrus-ci_retrospective integration and unit testing from this PR's 36c2bc68e9f72ad11d3cf23d6895b8d640c9ab41.

[Luap99]

LGTM

[mheon]

LGTM

[cevich]

Thanks guys, merging.

[mtrmac]

For the record, later we found at https://go.dev/ref/mod :

For reproducibility, the go command writes its own toolchain name in a toolchain line any time it is updating the go version in the go.mod file (usually during go get).

So dependency updates should, most of the time, not trigger a toolchain directive update - except when that dependency update triggers an update to the required Go language version.

[Luap99]

Also to confirm this change seem to work: containers/common#1915

It no longer bumps go+add toolchain there, however our newer version in f39 does that and therefore the make vendor check is failing which is what we want for now I guess.