Hi, i'm working on resolving a medium CVE in infracost related to the dependency square/go-jose. The module has been moved to another organization. From https://github.com/square/go-jose to https://github.com/go-jose/go-jose . Is it alright if I create a PR updating this?