Move the stmgr version to integration/go.mod

This makes it overridable via go work. Does not add that dependency to the top-level go.mod, since (i) that would result in a circular dependency (could be reconsidered if library parts are split out from stboot) and (ii) to not inflate the list of stboot dependencies.