Adding security scanning to a Go pipeline

Phase 2 added a pipeline that fails the build on known vulnerabilities.

The jobs

- name: govulncheck
  run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
- name: gosec
  run: go run github.com/securego/gosec/v2/cmd/gosec@latest ./...

What it found

gosec flagged 4 issues on the first run. 3 were real, and one was a false positive on a constant file path.