deps: move go-git and go-billy to main

go-git main reports a subtree TreeWalker cannot read instead of ending the walk with io.EOF (go-git/go-git#2555). The closure regression test now requires that error, so a regression shows up here too.

It also rejects truncated packs and decodes tree entry modes as git does, which changes the SHA-256 hash convert-sha256 gives a tree whose file mode has a non-owner execute bit. The CHANGELOG notes both.