go.mod: bump osbuild/images to v0.158.0

Use the version that contains the updated Koji upload code.

Also bump the version of `osbuild/blueprint` due to the new `uri` field
in file customizations.

Signed-off-by: Tomáš Hozza <thozza@redhat.com>

internal/cloudapi/v2/handler.go

@@ -724,7 +724,7 @@ func stagesToPackageMetadata(stages []osbuild.RPMStageMetadata) []PackageMetadat
 					Release:   rpm.Release,
 					Epoch:     rpm.Epoch,
 					Arch:      rpm.Arch,
-					Signature: osbuild.RPMPackageMetadataToSignature(rpm),
+					Signature: rpm.Signature(),
 					Sigmd5:    rpm.SigMD5,
 				},
 			)

internal/upload/koji/koji.go

@@ -1,3 +1,8 @@
+//go:build cgo
+
+// koji requires the khttp kerberos module which requires cgo so when
+// build without cgo kerberos uploads are currently not supported
+
 package koji
 
 import (
@@ -306,6 +311,8 @@ func (k *Koji) Upload(file io.Reader, filepath, filename string) (string, uint64
 			return "", 0, err
 		}
 
+		// NB: the 'n' returned by Read() of an io.Reader can never be negative
+		/* #nosec G115 */
 		offset += uint64(n)
 
 		m, err := hash.Write(chunk[:n])

internal/upload/koji/metadata-rpm.go

@@ -57,7 +57,7 @@ func OSBuildMetadataToRPMs(stagesMetadata map[string]osbuild.StageMetadata) []RP
 					Release:   pkg.Release,
 					Arch:      pkg.Arch,
 					Sigmd5:    pkg.SigMD5,
-					Signature: osbuild.RPMPackageMetadataToSignature(pkg),
+					Signature: pkg.Signature(),
 				})
 			}
 		default: