Fix never-ending pull

[sed-i]

Issue

Pulling of the grafana-ui part never ends, filling up disk space.
canonical/craft-parts#1360

Solution

Use source-branch instead of source-commit.

Drive-by: bump go-lang version to address some of the (false-positive?) vulns reported in oci-factory:

open grafana_234e39d1d7f0f7ceb1812922f9806fa596b8ad45_9.5.21.vulnerability-report.json 
| get scanner.result.Results 
| skip 1 
| get Vulnerabilities 
| flatten 
| select Severity VulnerabilityID PkgName InstalledVersion FixedVersion 
| uniq-by VulnerabilityID 
| sort-by VulnerabilityID

╭────┬──────────┬─────────────────┬──────────────────────────────────────────┬──────────────────┬─────────────────╮
│  # │ Severity │ VulnerabilityID │                 PkgName                  │ InstalledVersion │  FixedVersion   │
├────┼──────────┼─────────────────┼──────────────────────────────────────────┼──────────────────┼─────────────────┤
│  0 │ HIGH     │ CVE-2023-45288  │ stdlib                                   │ 1.22.0           │ 1.21.9, 1.22.2  │
│  1 │ HIGH     │ CVE-2024-24788  │ stdlib                                   │ 1.22.0           │ 1.22.3          │
│  2 │ CRITICAL │ CVE-2024-24790  │ stdlib                                   │ 1.22.0           │ 1.21.11, 1.22.4 │
│  3 │ HIGH     │ CVE-2024-34156  │ stdlib                                   │ 1.22.0           │ 1.22.7, 1.23.1  │
│  4 │ CRITICAL │ CVE-2024-8986   │ github.com/grafana/grafana-plugin-sdk-go │ v0.157.0         │ 0.250.0         │
│  5 │ CRITICAL │ CVE-2025-21613  │ github.com/go-git/go-git/v5              │ v5.11.0          │ 5.13.0          │
│  6 │ HIGH     │ CVE-2025-21614  │ github.com/go-git/go-git/v5              │ v5.11.0          │ 5.13.0          │
│  7 │ HIGH     │ CVE-2025-22868  │ golang.org/x/oauth2                      │ v0.20.0          │ 0.27.0          │
│  8 │ HIGH     │ CVE-2025-22869  │ golang.org/x/crypto                      │ v0.24.0          │ 0.35.0          │
│  9 │ HIGH     │ CVE-2025-30204  │ github.com/golang-jwt/jwt/v4             │ v4.5.0           │ 4.5.2           │
│ 10 │ HIGH     │ CVE-2025-47907  │ stdlib                                   │ 1.22.0           │ 1.23.12, 1.24.6 │
╰────┴──────────┴─────────────────┴──────────────────────────────────────────┴──────────────────┴─────────────────╯