chore: update moby/buildkit to v0.20.1 (#519)

**Description:**  
This PR updates the `moby/buildkit` dependency to `v0.20.1` in order to
remain compatible with recent changes required by GitHub Actions (GHA)
caching.

During the upgrade, several upstream behavioral changes required forking
and restoring legacy logic to maintain compatibility:

- Introduced `containsGithubToken` to replicate logic that was
previously in `buildflags.ParseCacheEntry`, which is now removed. This
check ensures we return `nil` instead of a zero-value object.
- Forked the previous implementation of `ParseExports`, as its upstream
logic changed significantly. This ensures short-term compatibility for
release before the GHA deprecation deadline.
- A follow-up issue will be created to improve this forked logic and
align more closely with upstream behavior.

🚨 **Fixes critical issue:**  
This change addresses a high-priority issue where GitHub Actions cache
will stop working due to the upcoming deprecation of the legacy caching
service (effective **April 15, 2025**).

Recent build failures showed errors like:
> *"This legacy service is shutting down, effective April 15, 2025.
Migrate to the new service ASAP. For more information:
https://gh.io/gha-cache-sunset"*

Root cause was identified in #515, where using `buildx >= 0.21.0` is
required.
This repo was previously using `buildx 0.18.0`.

Closes: #515

provider/internal/cache.go

@@ -472,7 +472,23 @@ func (c CacheFrom) validate(preview bool) (*controllerapi.CacheOptionsEntry, err
 		// environment variables set. Ignore the cacheFrom entry in this case.
 		return nil, nil
 	}
-	return parsed[0], nil
+
+	pb := parsed[0].ToPB()
+	if !containsGithubToken(pb) {
+		pb = nil
+	}
+
+	return pb, nil
+}
+
+// containsGithubToken checks if the GitHub token is set in the cache entry.
+// If it is not a GHA cache entry, it will return true.
+// This is to maintain backwards compatibility with the old buildx behaviour.
+func containsGithubToken(ci *controllerapi.CacheOptionsEntry) bool {
+	if ci.Type != "gha" {
+		return true
+	}
+	return ci.Attrs["token"] != "" && ci.Attrs["url"] != ""
 }
 
 // CacheToInline embeds cache information directly into an image.
@@ -680,7 +696,13 @@ func (c CacheTo) validate(preview bool) (*controllerapi.CacheOptionsEntry, error
 		// environment variables set. Ignore the cacheTo entry in this case.
 		return nil, nil
 	}
-	return parsed[0], nil
+
+	pb := parsed[0].ToPB()
+	if !containsGithubToken(pb) {
+		pb = nil
+	}
+
+	return pb, nil
 }
 
 // CacheMode controls the complexity of exported cache manifests.