feat: update hashicorp/packer to v1.16.0 #minor

[public-glueops-renovatebot]

This PR contains the following updates:

Package	Update	Change
hashicorp/packer	minor	1.15.4 → 1.16.0

---

Release Notes

hashicorp/packer (hashicorp/packer)

v1.16.0

Compare Source

1.16.0 (July 24, 2026)

FEATURES:

• provenance: add new provenance post-processor and packer verify-attestation command for
  SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts,
  builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud
  KMS (awskms://, gcpkms://, azurekms://, hashivault://), or keyless Sigstore (Fulcio +
  optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible
  delegated-signing patterns are included under examples/ci/.
  GH-13667
• core/hcl2: add rfc3339_parse and unix_timestamp_parse template functions. Both accept
  RFC 3339 timestamps; unix_timestamp_parse additionally accepts Unix epoch integers.
  GH-13669
• core/hcl2: add continue_on_error meta-argument to provisioner blocks. When set to true,
  a provisioner failure is logged and the build continues rather than halting.
  GH-13674
• core/hcl2: variable object types now support optional() attribute modifiers, allowing
  object variables to declare per-attribute defaults and omit fields that have a default set.
  GH-13670

BUG FIXES:

• plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling.
  GH-13680
• build: update build constraints to support arm architecture on FreeBSD.
  GH-13650

SECURITY:

• security: drop x/crypto/openpgp by upgrading go-github v33 → v75.
  GH-13676
• security: suppress false positive for GO-2026-5932.
  GH-13677
• deps: bump golang.org/x/crypto to v0.54.0.
  GH-13672

DEPENDENCIES:

• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.10.
  GH-13673
• deps: bump github.com/hashicorp/hcp-sdk-go to v0.174.0.
  GH-13673
• deps: bump github.com/zclconf/go-cty to v1.18.1.
  GH-13673
• deps: bump github.com/google/go-github v33 → v75.
  GH-13676
• deps: bump golang.org/x/net to v0.56.0.
  GH-13664
• deps: update various Go module dependencies.
  GH-13673

INTERNAL:

• ci: pin GitHub Action refs to latest verified SHAs.
  GH-13675
• chore: remove old website references.
  GH-13668

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.