go.mod: bump the most-deps group with 2 updates

[dependabot]

Bumps the most-deps group with 2 updates: github.com/google/cel-go and github.com/rogpeppe/go-internal.

Updates github.com/google/cel-go from 0.30.0 to 0.31.0

Release notes

Sourced from github.com/google/cel-go's releases.

Release v0.31.0

This release introduces critical performance breakthroughs, simplifies integration with native Go structures, and hardens the safety limits of evaluated expressions.

Features

Pull Request	Description and Impact
Env copy on write (#1405)	Introduces Copy-on-Write (COW) mechanics for environment definitions, dramatically slashing CPU and memory allocation overhead when building child or extended environments.
Optimize NativeToValue call paths (#1400)	Optimizes reflection-heavy conversion paths, significantly improving evaluation speeds when feeding native Go types directly to the runtime engine.
Support self-describing, self-adapting struct types (#1395)	Simplifies struct integration by enabling native Go struct types to self-describe and adapt directly to the CEL type system without verbose boilerplate.
Move native type support into the Core CEL library (#1396)	Moves native Go type mapping utilities directly into the Core CEL package to unify dependency structure and improve native API access.
Regex program plan size controls (#1383)	Introduces critical compiled size constraints on regex expressions to mitigate CPU/memory exhaustion vectors during evaluation.
Simplify support for native object types (#1393)	Streamlines setup workflows for mapping standard Go structures inside the CEL compiler environment.
Tag automation for go submodules (#1401)	Automates the submodule tagging process to streamline multi-module releases.

Fixes

Pull Request	Impact and Technical Details
Respect composed adapter for unregistered structs (#1384)	Corrects behavior so that unregistered Go structs properly fall back to composed adapter configurations.
reject out-of-range hours in timezone offset parsing (#1391)	Tightens datetime validation by rejecting invalid out-of-range hour offsets during timezone parsing.
Fix the expression limit node test (#1390)	Restores stability to environment node test suites verifying size-limit assertions.
Correct documented default max value for lists.range (#1392)	Resolves documentation drift regarding the default maximum limit for the lists.range function.

Breaking Changes

There are no breaking changes, but all ext.NativeTypes features are now available via cel.NativeTypes

Notes on Performance

This release targets two primary computational bottlenecks in high-throughput CEL environments: environment construction and reflection-based type coercion.

Expected Impact

1. Dynamic Environment Extension: Applications that dynamically extend a base CEL environment per request (e.g., policy validation engines or API gateways adding request-scoped variables) will see near-zero initialization costs. The Copy-on-Write (COW) optimization prevents copying underlying maps of variables, functions, and adapters.
2. Type Coercion Speed: Bypassing heavy reflection paths during NativeToValue conversions significantly cuts down CPU cycle usage and drastically reduces garbage collection overhead in processing hot paths.
3. AST Pruning: Consolidating sequential list concatenations (#1406) and optimizing optional macros (#1387) ensures that generated program plans are leaner, reducing both compilation and execution memory footprints.

Go-lang Benchmark Citation (benchstat)

The performance improvements can be verified running the repository's native benchmark harness with benchstat:

name old time/op new time/op delta
BenchmarkEnvExtension/10_vars 3.56µs ± 1% 0.15µs ± 0% -95.79% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 120ns ± 2% 42ns ± 1% -65.00% (p=0.000 n=10+10)
BenchmarkOptionalMapEvaluation 245ns ± 1% 195ns ± 1% -20.41% (p=0.000 n=10+10)

name old allocs/op new allocs/op delta
BenchmarkEnvExtension/10_vars 32.0 ± 0% 1.0 ± 0% -96.88% (p=0.000 n=10+10)
BenchmarkNativeToValue/struct 3.00 ± 0% 1.00 ± 0% -66.67% (p=0.000 n=10+10)

... (truncated)

Commits

• 2cf1626 Env copy on write (#1405)
• b74d303 Fold list concat expressions together (#1406)
• 9d5baaf Program plan optimizations (#1399)
• 1a53cb7 Release Tag Automation for go submodules (#1401)
• f10a2e6 Optimize NativeToValue call paths (#1400)
• ab72257 Move native type support into the Core CEL library (#1396)
• ba6c27e Support self-describing, self-adapting struct types (#1395)
• 7c1df6b reject out-of-range hours in timezone offset parsing (#1391)
• c15365a Simplify support for native object types (#1393)
• 8c1485e Correct documented default max value for range (#1392)
• Additional commits viewable in compare view

Updates github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0

Commits

• 49d4e9d testscript/plugin: new package (#307)
• b82995b testscript: add dynamic command capability (#306)
• 5cab5df goproxytest: make .mod and .info files optional (#305)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.