chore: bump github.com/containerd/containerd/v2 from 2.1.1 to 2.2.9

[stirby]

Bumps containerd to 2.2.9, the latest 2.2.x. envbuilder reaches containerd transitively through kaniko and go-containerregistry. govulncheck: 75 reachable to 55, fixing 20.

The CRI, checkpoint-import and runAsNonRoot advisories are Kubernetes node-runtime code that envbuilder does not run, but the module is linked and flagged.

Changes beyond go get:

• Adds replace github.com/vishvananda/netlink => v1.2.1-beta.2. containerd 2.2 requires netlink 1.3.1, which breaks the build of github.com/tailscale/netlink (pulled in by the Coder SDK). coder/coder pins the same version. The existing exclude block for netlink 1.3.0 tried to address this but exclude cannot stop an upgrade to 1.3.1.
• Bumps go directive to 1.25.0.

Part of a set of independent dependency PRs. All touch go.mod/go.sum, so rebase with go mod tidy after the first one merges.

Generated by Coder Agents on behalf of @stirby.