introduce build.provenance and sbom support - #13067

This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [docker/compose](https://github.com/docker/compose) | minor | `v2.38.2` -> `v2.39.1` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>docker/compose (docker/compose)</summary>

### [`v2.39.1`](https://github.com/docker/compose/releases/tag/v2.39.1)

[Compare Source](docker/compose@v2.39.0...v2.39.1)

#### What's Changed

🔧 Internal

- Add info about models usage to OpenTelemetry spans by [@&#8203;glours](https://github.com/glours) in docker/compose#13094

⚙️ Dependencies

- Bump compose-go to v2.8.1 by [@&#8203;glours](https://github.com/glours) in docker/compose#13096

**Full Changelog**: docker/compose@v2.39.0...v2.39.1

### [`v2.39.0`](https://github.com/docker/compose/releases/tag/v2.39.0)

[Compare Source](docker/compose@v2.38.2...v2.39.0)

#### What's Changed

##### ✨ Improvements

- Add `--since` & `--until` flags to `events` command by [@&#8203;jarqvi](https://github.com/jarqvi) in docker/compose#13030
- Feat(os): add FreeBSD support by [@&#8203;atagtm](https://github.com/atagtm) in docker/compose#13036
- Add `--models` flag to `config` command by [@&#8203;jarqvi](https://github.com/jarqvi) in docker/compose#13022
- Warn user `COMPOSE_BAKE=false` is deprecated by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13065
- Simpler stop UI by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13064
- Introduce build `provenance` and `sbom` attributes support by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13067
- Show build progress during watch rebuild by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13059

##### 🐛 Fixes

- Add dry-run support to bake build by [@&#8203;glours](https://github.com/glours) in docker/compose#13042
- Keep containers attached on stop to capture termination logs by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13010
- Add default compose labels to images built from bake by [@&#8203;glours](https://github.com/glours) in docker/compose#13049
- Fix report image name in bake result by [@&#8203;principis](https://github.com/principis) in docker/compose#13047
- Don't run navigation menu if stdin isn't a terminal by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13054
- Monitor must watch events even when context is cancelled by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13062
- Force `plain` display mode if stdout isn't a terminal by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13074
- Do not pass user id on Windows system as engine is not able to handel it by [@&#8203;glours](https://github.com/glours) in docker/compose#13080
- Forward git command error to user by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13084
- Use output registry when push true and load to docker store if not by [@&#8203;glours](https://github.com/glours) in docker/compose#13085

##### 🔧  Internal

- Add a space character to separate the timestamp from the log message by [@&#8203;xduugu](https://github.com/xduugu) in docker/compose#13038
- Fix the Helm bridge e2e tests after the latest update of the templates by [@&#8203;glours](https://github.com/glours) in docker/compose#13053
- Introduce monitor to manage containers events and application termination by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#12906
- Abstract model-cli commands execution with a model (pseudo) API by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13051
- Swarm by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13071
- Remove uses of `moby/errdefs` by [@&#8203;thaJeztah](https://github.com/thaJeztah) in docker/compose#13076
- Use local copy of `pkg/system.IsAbs` by [@&#8203;thaJeztah](https://github.com/thaJeztah) in docker/compose#13075
- Optimize ansiColorCode by replacing fmt.Sprintf with strings.Builder by [@&#8203;suwakei](https://github.com/suwakei) in docker/compose#13091
- Eliminate magic number in init functions by [@&#8203;suwakei](https://github.com/suwakei) in docker/compose#13090
- Integration of SetAttributes calls by [@&#8203;suwakei](https://github.com/suwakei) in docker/compose#13089

##### ⚙️ Dependencies

- Bump engine and cli to `v28.3.2` by [@&#8203;ndeloof](https://github.com/ndeloof) in docker/compose#13035
- Build(deps): bump github.com/spf13/pflag from `1.0.6` to `1.0.7` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in docker/compose#13060
- Bump `compose-go` to version `v2.8.0` by [@&#8203;glours](https://github.com/glours) in docker/compose#13082
- Build(deps): bump google.golang.org/grpc from `1.73.0` to `1.74.2` by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in docker/compose#13081
- bump buildx to `v0.26.1` by [@&#8203;glours](https://github.com/glours) in docker/compose#13086

#### New Contributors

- [@&#8203;atagtm](https://github.com/atagtm) made their first contribution in docker/compose#13036
- [@&#8203;xduugu](https://github.com/xduugu) made their first contribution in docker/compose#13038
- [@&#8203;principis](https://github.com/principis) made their first contribution in docker/compose#13047
- [@&#8203;suwakei](https://github.com/suwakei) made their first contribution in docker/compose#13091

**Full Changelog**: docker/compose@v2.38.2...v2.39.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MC42Mi4xIiwidXBkYXRlZEluVmVyIjoiNDAuNjIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90Il19-->

docker-compose.yml sets build.provenance / build.sbom. Compose added
those keys in v2.39.0 (docker/compose#13067, compose-go v2.8.0); Compose
2.38.x ships compose-go v2.7.1, whose schema has additionalProperties:
false on `build`, so it rejects the file. check_docker accepted any 2.x.

stack.sh now parses `docker compose version --short` (2.40.3, v2.39.0,
v2.39.0-desktop.1, 2.39.0+build, missing patch = 0) and compares it
numerically per component against STACK_COMPOSE_MIN_VERSION=2.39.0. An
older Compose stops with the found version, why it is too old and where
to upgrade; an unparseable version stops with its own message. Addresses
Copilot review 4129574025.

Tests (scripts/test/stack-lib.test.sh): parse cases incl. edge formats,
at-least verdicts (2.100.0 > 2.39.0, 2.38.2 / v2.38.9-desktop.1 too old,
garbage unparseable), check_docker against a fake docker for refused,
accepted and unparseable versions. The teardown fake docker now reports
2.40.3.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The prerequisite said "Compose v2". docker-compose.yml sets
build.provenance / build.sbom, added in Compose 2.39.0
(docker/compose#13067, compose-go v2.8.0); Compose 2.38.x rejects them.
The README now states 2.39.0+, why, and that standup enforces it (the
check landed in 74baa7d). Addresses Copilot review 4129574085.

Co-Authored-By: Claude Opus 5.5 <[email protected]>