Pin govulncheck-action to master commit with Node.js 24 support

The latest release (v1.0.4) bundles checkout@v4.1.1 and
setup-go@v5.0.0 which trigger Node.js 20 deprecation warnings.
Master has updated to checkout@v6.0.2 and setup-go@v6.2.0.

Author: combor

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - id: govulncheck
-        uses: golang/govulncheck-action@v1
+        uses: golang/govulncheck-action@31f7c5463448f83528bd771c2d978d940080c9fd # master, uses checkout@v6.0.2 + setup-go@v6.2.0
 
   build:
     name: Build