NH-137757 Lambda: recent Go and Prometheus-related vulnerabilities reported

[jerrytfleung]

• Synced upstream latest changes

https://swicloud.atlassian.net/browse/NH-137757

[Copilot]

Pull request overview

This PR syncs upstream updates to address recently reported Go/Prometheus-related vulnerabilities and aligns the embedded Collector/Contrib component set with newer OpenTelemetry Collector releases. It also improves Telemetry API receiver behavior (metric timestamps and richer function-log attributes), adjusts tooling (coverage and CI output), and refines collector logging-level handling.

Changes:

• Bumped OpenTelemetry Collector/Contrib and related dependencies across modules (including zap, golang.org/x/net, Prometheus transitive deps) to pick up vulnerability fixes.
• Updated Telemetry API receiver to (a) timestamp exported metrics using the most recent event time and (b) attach additional JSON fields as log attributes for function logs, plus added tests/docs for these behaviors.
• Added transformprocessor to the default layer build (and documented deprecation of attributes, resource, and span processors), replaced go-acc coverage with go test coverage, and enhanced CI to report artifact sizes.

Reviewed changes

Copilot reviewed 22 out of 28 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
collector/receiver/telemetryapireceiver/receiver.go	Track last event time for metric timestamps; enrich function logs by mapping extra JSON fields into log attributes.
collector/receiver/telemetryapireceiver/receiver_test.go	Adds tests for metric timestamp behavior and function-log attribute mapping.
collector/receiver/telemetryapireceiver/README.md	Documents reserved log metadata fields for function JSON logs.
collector/receiver/telemetryapireceiver/go.mod	Updates receiver module deps to newer Collector/Contrib/Zap versions.
collector/receiver/telemetryapireceiver/go.sum	Reflects updated receiver module dependency checksums.
collector/README.md	Adds deprecation notice for processors in default build; recommends transform processor.
collector/processor/decoupleprocessor/go.mod	Updates decouple processor module deps to newer Collector/Zap versions.
collector/processor/decoupleprocessor/go.sum	Reflects updated decouple processor dependency checksums.
collector/processor/coldstartprocessor/go.mod	Updates coldstart processor module deps to newer Collector/Zap versions.
collector/processor/coldstartprocessor/go.sum	Reflects updated coldstart processor dependency checksums.
collector/Makefile.Common	Replaces go-acc coverage with go test -coverprofile flow.
collector/Makefile	Removes go-acc from installed tools list.
collector/lambdacomponents/processor/transform.go	Adds transform processor factory behind custom build tags.
collector/lambdacomponents/go.mod	Updates lambdacomponents deps and adds transformprocessor.
collector/lambdacomponents/default.go	Includes transformprocessor in default component factories.
collector/internal/tools/tools.go	Removes go-acc tool import from tools module.
collector/internal/tools/go.mod	Updates tools dependencies and removes go-acc.
collector/internal/tools/go.sum	Reflects updated tools module dependency checksums.
collector/internal/collector/testdata/config-error-level.yaml	Adds test config fixture to validate collector log-level behavior.
collector/internal/collector/collector.go	Adjusts zap core wrapping to better respect collector config log levels.
collector/internal/collector/collector_test.go	Adds test ensuring collector config log level can suppress INFO logs.
collector/go.mod	Updates collector root module deps and adds explicit test deps.
.github/workflows/ossf-scorecard.yml	Updates pinned upload-sarif action commit.
.github/workflows/layer-publish.yml	Updates pinned configure-aws-credentials action commit.
.github/workflows/codeql.yml	Updates pinned CodeQL action commits.
.github/workflows/ci-collector.yml	Updates cache action pin and adds artifact size output to job summary.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cheempz]

LGTM