Build against upstream govips

[beetlebugorg]

What changes

go.mod replaced govips with a May 2025 fork while the require line named v2.16.0. A replace applies only to the main module, so anyone importing go-dims as a library built against a different govips than the released binary.

The fork is no longer needed. Its changes are in upstream v2.18.0.

• Remove the replace directive.
• Move github.com/davidbyttow/govips/v2 to v2.18.0.
• Drop the fork URL from LICENSES/govips.MIT, which listed both projects.

The fork carried nothing upstream lacks

The fork added 19 exported symbols and tests over upstream v2.16.0, among them ImageRef.Gravity, ImageRef.Background, ExportMagick, and the BMP and PSD support. Every one of them exists in v2.18.0:

symbols the fork added over v2.16.0:   19
of those, still missing in v2.18.0:     0

ImageRef.Gravity is the one go-dims depends on directly, in the watermark command.

Verify

go build ./... and go build -tags "lambda.norpc lambda" ./... both succeed. go test -race -count=1 ./... passes on the builder image, golden images included, so the byte-exact image comparisons hold across the change.

Rendered output was compared directly. Two binaries, one built with the fork and one with upstream, answered the same seven requests:

thumbnail + sharpen                      identical  11893 bytes
resize + percent crop + sharpen          identical   6435 bytes
thumbnail + sharpen + watermark          identical  11934 bytes
resize + webp + quality                  identical  14570 bytes
rotate + sepia + png                     identical   7447 bytes
autolevel + brightness + invert          identical   1117 bytes
svg source + thumbnail + gif             identical   2695 bytes

The watermark case exercises Gravity, the symbol the fork existed to provide.

govulncheck reports no vulnerabilities.