ci: add govulncheck workflow + README badge

.github/workflows/govulncheck.yml

@@ -0,0 +1,28 @@
+name: govulncheck
+
+# Scan this module and its dependencies for known vulnerabilities. Runs on every
+# push and pull request (so it gates merges to main), plus weekly to catch
+# newly-disclosed advisories in code that hasn't changed.
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '19 6 * * 1'   # Mondays 06:19 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - name: govulncheck ./...
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...

README.md

@@ -1,5 +1,7 @@
 # auth-go
 
+[![govulncheck](https://github.com/aauth-dev/auth-go/actions/workflows/govulncheck.yml/badge.svg)](https://github.com/aauth-dev/auth-go/actions/workflows/govulncheck.yml)
+
 [![Go Reference](https://pkg.go.dev/badge/github.com/aauth-dev/auth-go.svg)](https://pkg.go.dev/github.com/aauth-dev/auth-go)
 [![Go Report Card](https://goreportcard.com/badge/github.com/aauth-dev/auth-go)](https://goreportcard.com/report/github.com/aauth-dev/auth-go)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)