[scanner] fix: resolve gosec security findings in kb/rag (#19280)

Signed-off-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: clubanderson

pkg/kb/rag/embedder.go

@@ -62,7 +62,8 @@ func Quantize(v []float32) []uint64 {
 	code := make([]uint64, (len(v)+63)/64)
 	for i, x := range v {
 		if x >= 0 {
-			code[i/64] |= 1 << uint(i%64)
+			// Safe conversion: i%64 is always in [0,63], well within uint range.
+			code[i/64] |= 1 << uint(i%64) // #nosec G115
 		}
 	}
 	return code

pkg/kb/rag/hashembedder.go

@@ -100,7 +100,9 @@ func (e *HashEmbedder) addFeature(vec []float32, feature string, weight float64)
 	h := fnv.New64a()
 	_, _ = h.Write([]byte(feature))
 	sum := h.Sum64()
-	idx := int(sum % uint64(e.dim))
+	// Safe conversion: sum % uint64(e.dim) is always < e.dim (typically 512),
+	// well within int range even on 32-bit systems.
+	idx := int(sum % uint64(e.dim)) // #nosec G115
 	sign := float32(1)
 	if sum&(1<<63) != 0 {
 		sign = -1