Bump Prometheus to version 3.13.2 (19-2-stable)

What does this MR do and why?

Backports !9666 (merged) (Bump Prometheus to version 3.13.2) to 19-2-stable.

Prometheus 3.11.2 has reached EOL. 3.13 is an LTS release with support until July 2027, so this bump moves the stable branch back onto a supported version. It also resolves known vulnerabilities in dependencies of the currently bundled Prometheus 3.11.2 (see #10040, confidential).

Changes (cherry-picked from 40a0930e and adapted for the stable branch):

• config/software/prometheus.rb: bump Prometheus version from 3.11.2 to 3.13.2.
• support/dependency_decisions.yml: allowlist the MPL-2.0 licensed transitive Go dependencies pulled in by the new Prometheus version:
  • github.com/hashicorp/go-version: unpin the existing entry (:versions: [ v1.8.0 ] → :versions: []) so the version required by Prometheus 3.13.2 is covered.
  • github.com/hashicorp/nomad/api: add a new unpinned entry, since the existing one is pinned to v0.0.0-20260324203407-b27b0c2e019a and does not cover the version pulled in by Prometheus 3.13.2.
• gitlab-ci-config/variables.yml: bump BUILDER_IMAGE_REVISION from 5.63.2 to 5.63.3.

Instead of moving 19-2-stable to the 5.66.0 builder image used by the original MR (which would pull in all unrelated builder changes between 5.63.x and 5.66.0), the required Node.js 22.22.3 and pnpm changes were backported to the 5-63-stable builder branch in gitlab-omnibus-builder!504 (merged) and released as the 5.63.3 patch tag. This keeps the stable branch on the 5.63.z builder line.

Dependencies

• gitlab-omnibus-builder!504 (merged) (merged): backports Node.js 22.22.3 and pnpm support to 5-63-stable, released as builder tag 5.63.3.

Related issues

• Related #10031 (closed)
• Related #10040 (confidential)

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• This MR is backporting a bug fix, documentation update, or spec fix, previously merged in the default branch.
• The original MR has been deployed to GitLab.com (not applicable for documentation or spec changes).
• This MR has a severity label assigned (if applicable).

Note to the merge request author and maintainer

If you have questions about the patch release process, please:

• Refer to the patch release runbook for engineers and maintainers for guidance.
• Ask questions on the #releases Slack channel (internal only).