Update step-runner to version 0.43.0

What does this MR do?

Bumps gitlab.com/gitlab-org/step-runner from v0.41.0 to v0.43.0, and adapts our builtins to the interface change that comes with it.

v0.42.0 changes runner.BuiltinFunction: Run now returns (runner.BuiltinResult, error) rather than just error. BuiltinResult carries a builtin's Outputs and Exports.

Our two builtins are updated accordingly:

• functions/concrete and functions/script_legacy use the new signature.
• Neither declares outputs in its Spec(), and script_legacy propagates env through the gitlab_runner_env file rather than Exports, so both return an empty BuiltinResult on every path. Nothing is dropped.
• In concrete, the local runner variable is renamed to stageRunner. It shadowed the imported step-runner runner package, which the new signature needs to reference from inside the function body.

v0.43.0 is a much smaller release: it adds file-type variable values to step-runner's own job log mask list (pkg/api/service). We don't import that package, and our masking lives in common/buildlogger, so it needs no changes on our side.

go mod tidy also pulled in transitive bumps: go-git/v5, go-billy/v5, docker-credential-helpers, klauspost/cpuid/v2, go.yaml.in/yaml/v3, and genproto/googleapis/rpc.

Worth noting for future builtins: v0.42.0's RegisterBuiltin now rejects a builtin whose spec sets OutputMethod_delegate, since a BuiltinResult has no way to carry a delegated sub-step result. Neither of ours does, so registration is unaffected. This check is still in place in v0.43.0.

Why was this MR needed?

To keep the vendored step-runner current and pick up v0.42.0 and v0.43.0.