Remove replace directives from go.mod

[vdemeester]

Remove replace directives from go.mod

Once #3332 lands (OpenCensus → OpenTelemetry migration), we should be able to remove most/all replace directives from go.mod and align dependencies with tektoncd/pipeline.

Current replace directives

Replace	Reason	Can remove?
k8s.io/api, apimachinery, client-go, code-generator, apiextensions-apiserver, kube-openapi	Pinned to old k8s versions due to knative.dev/pkg requiring k8s.io/client-go@v1.5.2	✅ Yes, after bumping knative.dev/pkg and PAC
knative.dev/pkg	Pinned to old version that still has metrics package (removed upstream)	✅ Yes, after #3332
knative.dev/eventing	Transitive dependency, not directly used	✅ Yes
github.com/go-jose/go-jose/v4	Security pin v4.1.3 → v4.1.4	✅ Likely, check if latest resolves to v4.1.4+
github.com/alibabacloud-go/cr-20160607	Fork with actual fixes	❌ Likely needs to stay

Steps

1. Wait for Migrate metrics from OpenCensus to OpenTelemetry #3332 to merge (bumps knative.dev/pkg, removes OpenCensus usage)
2. Bump knative.dev/pkg to align with tektoncd/pipeline (v0.0.0-20260318013857-98d5a706d4fd)
3. Bump openshift-pipelines/pipelines-as-code from v0.42.0 to v0.45.0 — this removes the transitive k8s.io/client-go@v1.5.2 requirement (the root cause of needing the k8s.io replaces)
4. Bump k8s.io deps to v0.35.3 (aligned with pipeline) and remove all k8s.io replace directives
5. Remove remaining replaces (knative.dev/eventing, knative.dev/pkg, go-jose)
6. Run go mod tidy and regenerate vendor/codegen

Context

tektoncd/pipeline has no k8s.io or knative replaces — we should align with that.

/kind cleanup