Automate govulncheck CI #11209

Description

To stay on top of security issues in gh we would like to periodically run govulncheck in CI and be notified of any failures.

govulncheck can be incorporated in a number of ways to cli/cli repository:

1. Expand lint workflow to include run govulncheck, failing pull requests if a Go security vulnerability is detected

2. Create a scheduled workflow that runs gvulncheck and uploads the resulting SARIF file to GitHub for code scanning alerts

Expected outcomes

• gh is scanned for Go vulnerabilities as part of SDLC process
• CLI maintainers have notification of new vulnerabilities via #cli-activity Slack channel