adopt goyaml/v3

[ndeloof]

Adopting go.yaml/v3 will bring support for yaml 1.2 schema

compatibility considerations:

• go.yaml/v3 uses 4 spaces for indentation by default. project.MarshalYAML() is configured to use only 2
• go.yaml/v3 force indentation on sequences (so the updated expected yaml in this PR). See Compact seq indent go-yaml/yaml#924

benefits:

• v3 branch is the active development branch for go.yaml
• nvd.nist.gov/vuln/detail/CVE-2019-11254
• go.yaml/v3 adds support for yaml.Node processing, which we could use to transform the model before applying to go structs. Typically can be used to introduce custom tags, like !inline as proposed on inline Dockerfile compose-spec#298

[AkihiroSuda]

What's current status of this?
I saw v3.0.0 was released recently.

[ndeloof]

I didn't noticed the v3.0.0 release, this is something we should consider for next release, wdyt @glours @ulyssessouza ?

[AkihiroSuda]

One of the reasons to adopt v3 would be that v2 has a vulnerability https://nvd.nist.gov/vuln/detail/CVE-2019-11254 .
Very unlikely to affect compose-go, but scanning tools are noisy about this CVE.

[AkihiroSuda]

Is there any blocker to get this merged? 🙏

[ndeloof]

updated with recent v3.0.1 release, still missing go-yaml/yaml#753

[laurazard]

LGTM 🎉