github: add govulncheck action to security workflow

[simondeziel]

No description provided.

[Copilot]

Pull request overview

This PR extends the repository’s GitHub Actions security workflow by adding a govulncheck job, enabling Go vulnerability scanning and publishing results to GitHub code scanning (SARIF).

Changes:

• Add a new govulncheck job that runs on ubuntu-24.04 for scheduled and manually-dispatched runs on main.
• Configure Go setup via go.mod, run golang/govulncheck-action with SARIF output, and upload the SARIF to GitHub code scanning.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/security.yml:156

• The govulncheck step will likely fail to analyze this module as-is because the repository contains CGO packages (and other CI workflows first install build deps and build/restore dqlite+liblxc before running Go tooling). Also, this job checks out a moving ref (main) but uploads SARIF using ${{ github.sha }}, which can mismatch the scanned commit; prefer uploading the SHA resolved after checkout.

      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          ref: main
          persist-credentials: false