chore: bump GAF (SARIF to UFM)

[octavian-snyk]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

Where should the reviewer start?

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

None

What are the relevant tickets?

CLI-1837

---

Note

Medium Risk
GAF is core CLI infrastructure; a version bump can change output formats, workflows, and exit-code handling even without local code edits.

Overview
Updates github.com/snyk/go-application-framework from v0.23.0 to pre-release v0.23.1-0.20260908131323-e6578970bb8c in cliv2 (direct require) and cliv2-private (transitive), with matching go.sum checksum updates.

There are no CLI source changes in this PR—the behavior shift comes from the new GAF version, aligned with ticket CLI-1837 and the SARIF → UFM work referenced in the title. Reviewers should treat this as consuming upstream GAF output/workflow changes rather than reviewing new logic in this repo.

^{Reviewed by Cursor Bugbot for commit f7557db. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 4 relevant code sections from 3 files (average relevance: 0.94) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) package-lock.json (2 segments, lines 19745-19957) CLAUDE.md (lines 1-65)

🤖 Repository instructions applied (from AGENTS.md)