fix(autoupdate): make Go major updates real

A Go major update changes the import path. Without rewriting imports the
PR only added the new module to go.mod, the tests passed, and Renovate
proposed it again. Rewrite the imports with gomodUpdateImportPaths so the
build tests the actual update, and cap indirect dependencies at their
current major, which the parent module decides.

.github/workflows/renovate-autoupdate.yaml

@@ -134,7 +134,8 @@ jobs:
               prConcurrentLimit: 0,
               prHourlyLimit: 0,
               branchConcurrentLimit: 0,
-              postUpdateOptions: ["gomodTidy"],
+              # A Go major update changes the import path: rewrite the imports, so the build tests the real update.
+              postUpdateOptions: ["gomodTidy", "gomodUpdateImportPaths"],
               statusCheckNames: {
                 artifactError: null,
                 configValidation: null,
@@ -149,6 +150,8 @@ jobs:
                     groupSlug: "batch"
                   } + (if $majors == "batch" then {} else {matchUpdateTypes: ["minor", "patch", "pin", "pinDigest", "digest"]} end)),
                   {matchManagers: ["gomod"], matchDepTypes: ["indirect"], enabled: true},
+                  # The parent module chooses the major version of an indirect dependency.
+                  {matchManagers: ["gomod"], matchDepTypes: ["indirect"], allowedVersions: "<{{add major 1}}.0.0"},
                   {matchPackageNames: ["typescript"], allowedVersions: "<7"}
                 ]
                 # Rules that disable by update type are ignored, but a version cap works.