ci: add govulncheck job

[kolyshkin]

This is to ensure our minimal dependencies do not have known vulnerabilities.

NOTES:

• govulncheck is not and will not be included into golangci-lint, thus a separate job.
• we do not specify Go version to be used here to avoid reporting vulnerabilities in stdlib which we're not interested in here;
• this is semi-useless for main branch as our dependencies are kept updated by dependabot. This makes more sense for release-* branches in which we don't routinely bump go deps.

[kolyshkin]

Similar to opencontainers/cgroups#15 (see some discussions in there).

[thaJeztah]

LGTM

probably should be cherry-picked to the release branches.

[thaJeztah]

probably should be cherry-picked to the release branches.

LOL and you already added labels for that 😅

[rata]

LGTM. We can't put this to run on a release branch only, I guess? (like some checks that can run on certain branches and so)

[kolyshkin]

LGTM. We can't put this to run on a release branch only, I guess? (like some checks that can run on certain branches and so)

We actually run CI a few times a week on release branches (from https://github.com/opencontainers/runc/blob/main/.github/workflows/scheduled.yml); the problem is the results are not very visible* (they can only be seen in https://github.com/opencontainers/runc/actions, and you have to scroll down or search).

*We even missed adding release-1.4 and 1.5 to that file; opened #5393 to fix.