ci: pin the versions of govulncheck and gosec

[chrj]

govulncheck and gosec were installed with @latest, so the version moved on its own. A release of the tool turned a green run red with no change here.

This is what happened to keyrate today. gosec published v2.28.0, which needs Go 1.25.8, and the workflow runs the Go version in go.mod:

github.com/securego/gosec/v2@v2.28.0 requires go >= 1.25.8
(running go 1.25.0; GOTOOLCHAIN=local)

The daily run passed on the 9th through the 12th and stopped on the 13th, with nothing changed in this repository.

The change

Both tools are pinned:

• govulncheck@v1.7.0
• gosec@v2.28.0

GOTOOLCHAIN=auto is set on the install commands, and only there. actions/setup-go sets GOTOOLCHAIN=local, which stops Go from fetching the toolchain a tool asks for. With auto on that one command, Go fetches what it needs to build the tool, and the module is still read with the version in go.mod.

The alternative was to raise the go directive of this module. That asks the same of everybody who imports it, for the sake of a scanner, so it is not the right lever.

Verified

Reproduced the failure and the fix outside CI:

$ GOTOOLCHAIN=go1.25.0 go install .../gosec@v2.28.0
requires go >= 1.25.8 (running go 1.25.0)

$ GOTOOLCHAIN=auto go install .../gosec@v2.28.0
$ gosec --version
Version: dev

Dependabot does not watch a version inside a run: step, so these move when you move them.