Update go-getter to the latest release now that hashicorp/go-getter#256 is merged. Also, pick up a xz CVE fix that go-getter merged in hashicorp/go-getter#279 .
golang.org/net packages are ancient - upgrading them to pick up important fixes, e.g. https://go-review.googlesource.com/c/go/+/87298/