feat: Bump routing-api and Migrate Database GORM from jinzhu/gorm to gorm.io/gorm v2

[ZPascal]

Bump routing-api and Migrate Database ORM from jinzhu/gorm to gorm.io/gorm v2

Summary

This PR updates the vendored code.cloudfoundry.org/routing-api dependency to a newer version and migrates the database layer from the legacy github.com/jinzhu/gorm (v1) and github.com/lib/pq stack to the modern gorm.io/gorm v2 ecosystem, along with replacing the PostgreSQL driver from lib/pq to jackc/pgx/v5.

---

Changes

Dependency / Module Updates (go.mod / go.sum)

Removed direct dependencies:

• github.com/jinzhu/gorm v1.9.16 — legacy GORM v1
• github.com/lib/pq v1.11.2 — legacy PostgreSQL driver
• github.com/go-sql-driver/mysql v1.9.3 — moved to indirect

Added new indirect dependencies (GORM v2 + pgx stack):

• gorm.io/gorm v1.31.1
• gorm.io/driver/mysql v1.6.0
• gorm.io/driver/postgres v1.6.0
• github.com/jackc/pgx/v5 v5.8.0 — modern PostgreSQL driver
• github.com/jackc/pgpassfile, pgservicefile, puddle/v2 — pgx dependencies
• github.com/jinzhu/now v1.1.5 — updated GORM v2 helper

Removed:

• github.com/denisenkom/go-mssqldb — no longer needed
• github.com/erikstmartin/go-testdb — no longer needed
• github.com/golang-sql/civil — no longer needed
• github.com/PuerkitoBio/goquery, andybalholm/cascadia — no longer needed

---

BOSH Package Spec (packages/routing-api/spec)

The BOSH package spec for routing-api has been updated to reflect the new dependency tree:

• Removed references to github.com/jinzhu/gorm (v1 dialects for MySQL and PostgreSQL) and github.com/lib/pq (all sub-packages).
• Added references to the full jackc/pgx/v5 package tree (core, pgconn, pgproto3, pgtype, pgxpool, stdlib, internal helpers) and jackc/puddle/v2.
• Added gorm.io/gorm, gorm.io/driver/mysql, gorm.io/driver/postgres and all their sub-packages.
• Added golang.org/x/sync/semaphore, golang.org/x/text/cases, golang.org/x/text/secure/precis, golang.org/x/text/width, golang.org/x/text/internal.
• Removed unused tedsuo/ifrit/grouper and tedsuo/ifrit/sigmon sub-packages.

---

Motivation

jinzhu/gorm (v1) is unmaintained and does not receive security updates. The new gorm.io/gorm v2 is the actively maintained successor with a cleaner API. Similarly, lib/pq is in maintenance-only mode, while jackc/pgx/v5 is the recommended, actively developed PostgreSQL driver with better performance and full support for modern PostgreSQL features (e.g., pgx protocol-level prepared statements, connection pooling via pgxpool).

---

Checklist

• go.mod / go.sum updated
• Vendor directory updated
• BOSH package spec updated (packages/routing-api/spec)
• DB layer migrated to GORM v2 + pgx v5
• Read the Contributing document.
• Update the vendors after merging of this PR

Backward Compatibility

Breaking Change: No

Notes

• PR description was done with the assistance of Claude (claude-sonnet-4-6, Anthropic) via GitHub Copilot.
• Connected PR