go.mod: bump osbuild/images to c2aa82cc9a86

images 0.1.0 and 0.2.0 were already released, but they are incompatible with
osbuild-composer's test suite. However, we need to support F40 as soon as
possible. This commit as a workaround: it bumps the dependency to a new enough
version that has Fedora 40, but it's old enough that it doesn't have
the breaking changes.

vendor/cloud.google.com/go/storage/http_client.go

@@ -32,6 +32,7 @@ import (
 	"cloud.google.com/go/iam/apiv1/iampb"
 	"cloud.google.com/go/internal/optional"
 	"cloud.google.com/go/internal/trace"
+	"github.com/googleapis/gax-go/v2/callctx"
 	"golang.org/x/oauth2/google"
 	"google.golang.org/api/googleapi"
 	"google.golang.org/api/iterator"
@@ -814,6 +815,15 @@ func (c *httpStorageClient) newRangeReaderXML(ctx context.Context, params *newRa
 		return nil, err
 	}
 
+	// Set custom headers passed in via the context. This is only required for XML;
+	// for gRPC & JSON this is handled in the GAPIC and Apiary layers respectively.
+	ctxHeaders := callctx.HeadersFromContext(ctx)
+	for k, vals := range ctxHeaders {
+		for _, v := range vals {
+			req.Header.Add(k, v)
+		}
+	}
+
 	reopen := readerReopen(ctx, req.Header, params, s,
 		func() (*http.Response, error) { return c.hc.Do(req) },
 		func() error { return setConditionsHeaders(req.Header, params.conds) },