build(deps): bump go.opentelemetry.io/otel to v1.40.0

[sreis]

• Bumps go.opentelemetry.io/otel and related packages from v1.39.0 to v1.40.0. Fixes CVE

go.opentelemetry.io/otel/sdk │ CVE-2026-24051 │ HIGH │ fixed │ v1.38.0 │ 1.40.0 │ OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution

• Ran go mod tidy and verified that all unit tests pass locally.

[sreis]

@Slach this is in the logs:

2026-03-04T14:57:58.9112899Z === NAME  TestCustomKopia
2026-03-04T14:57:58.9113481Z     utils.go:563: 
2026-03-04T14:57:58.9114571Z         	Error Trace:	/home/runner/work/clickhouse-backup/clickhouse-backup/test/integration/utils.go:563
2026-03-04T14:57:58.9116970Z         	            				/home/runner/work/clickhouse-backup/clickhouse-backup/test/integration/customKopia_test.go:14
2026-03-04T14:57:58.9119821Z         	Error:      	Received unexpected error:
2026-03-04T14:57:58.9121067Z         	            	exit status 2
2026-03-04T14:57:58.9121634Z         	Test:       	TestCustomKopia
2026-03-04T14:57:58.9123123Z         	Messages:   	exec project1-clickhouse-backup-1 bash -ce curl -sfL https://kopia.io/signing-key | gpg --dearmor -o /usr/share/keyrings/kopia-keyring.gpg
2026-03-04T14:57:58.9128808Z         	            	
2026-03-04T14:57:58.9129566Z         	            	gpg: no valid OpenPGP data found.
2026-03-04T14:57:58.9130094Z         	            	
2026-03-04T14:57:58.9130542Z         	            	[ERROR]
2026-03-04T14:57:58.9136945Z         	            	exit status 2

Do you know if the test is flaky?

[Slach]

yep. it could be a github actions environment which not allow download kopia pgp key properly