[Enhancement]: Compose module: Fix Go vulns by not depending on docker/docker indirectly

[pierrerx-rgor]

Proposal

The testcontainers-go compose module still depends on github.com/docker/docker@v28.5.2+incompatible which has currently 5 go vulns for its namesgenerator package.

The latest released tag of docker/docker is github.com/docker/docker@v28.5.2+incompatible, and the follow-up releases were and will only be in github.com/moby/moby/*@v29+ tags, but the used namesgenerator package became an internal package starting with v29.0.0.

Release Notes for docker // moby v29.0.0:

The Go module github.com/docker/docker is deprecated in favor of github.com/moby/moby/client and github.com/moby/moby/api. The github.com/moby/moby module is considered an internal implementation detail - the only supported public modules are client and api.
Starting with v29, releases are tagged with the docker- prefix (e.g., docker-v29.0.0). This only affects Go module users and package maintainers.

Instead, it seems more viable to avoid having docker/docker, moby/moby or moby/moby/v2 as a dependency.

The dependency tree that makes testcontainers/testcontainers-go/modules/compose to depend on docker/docker is:

- github.com/testcontainers/testcontainers-go/modules/compose
-- github.com/docker/compose/v5/pkg/compose
--- github.com/docker/buildx/store/storeutil
---- github.com/docker/buildx/store
----- github.com/docker/docker/pkg/namesgenerator

We can see that there are 2 modules in the middle of that tree : docker/compose/v5 , docker/buildx

Proposed Plan for fix Go vulns reports for users of testcontainers-go as fast as possible:

• docker/buildx must be made independent from docker/docker by replacing the import of package docker/docker/pkg/namesgenerator with an internal implementation for neutral builder IDs - WIP
• docker/buildx publishes new minor/patch release tag
• existing users of testcontainers/testcontainers-go/modules/compose can just run go get -u github.com/docker/buildx@latest && go mod tidy

Additionally, proposed Plan for fix Go vulns reports for all dependencies:

• docker/buildx must be made independent from docker/docker by replacing the import of package docker/docker/pkg/namesgenerator with an internal implementation for neutral builder IDs - WIP
• docker/buildx publishes new release tag
• docker/compose/v5 uses new release tag of docker/buildx and publishes new release tag
• testcontainers/testcontainers-go/modules/compose uses new release tag of docker/compose/v5

References for the Go vulns:

• https://pkg.go.dev/search?q=github.com%2Fdocker%2Fdocker&m=vuln
• https://deps.dev/go/github.com%2Fdocker%2Fdocker/v28.5.2+incompatible
• https://pkg.go.dev/github.com/docker/docker@v28.5.2+incompatible
• can't update docker/docker to v29.3.1 as a dependency of my module moby/moby#52284
• https://github.com/moby/moby/blob/docker-v29.6.1/README.md#migrating-from-githubcomdockerdocker
• https://github.com/moby/moby/releases/tag/docker-v29.0.0

---

Do you have another plan to avoid depending on github.com/docker/docker@v28.5.2+incompatible ?