YAML library used

(Created from #1437 so we can add it to the discussion milestone.)

We're using go-yaml.v3 in SOPS. Unfortunately this library doesn't seem to be actively maintained anymore; the last commit is from May 2022, and there are quite a few bug reports and bugfix PRs that haven't been looked at / haven't progressed, some of them for years. (I got one myself, https://github.com/go-yaml/yaml/pull/690, open since January 2021, last maintainer reaction in May 2021. This is blocking a bugfix on sops's side: https://github.com/getsops/sops/issues/936#issuecomment-917198987)

Two issues have been created in the past in the repository asking whether it's still maintained, and the (single) maintainer always responded that it still is:

• https://github.com/go-yaml/yaml/issues/788
• https://github.com/go-yaml/yaml/issues/776

Other projects have actually went on to fork go-yaml locally, like kubernetes-sigs:

• https://github.com/kubernetes-sigs/yaml/issues/72
• https://github.com/kubernetes-sigs/yaml/pull/76

Maybe we should also consider switching to that fork? Or is anyone aware of other forks of go-yaml.v3, or even other actively maintained YAML libraries for Go?

Start by reviewing the go-yaml.v3 repository, the linked go-yaml issues and pull request, and the kubernetes-sigs/yaml fork references. Compare available maintenance options for SOPS and determine whether a dependency change is warranted. Done means reaching and documenting a decision about keeping go-yaml.v3 or switching to another maintained library or fork.