Add govulncheck to ci/cd

[ties]

Add govulncheck, a conservative static analyzer that checks the reachability of vulnerabilities.

This provides an upper bound on the actual vulnerabilities that are applicable, and is lower-noise than generic checks that check if a vulnerable library is used.

closes #139

[ties]

Your code is affected by 8 vulnerabilities from 1 module and the Go standard library.
This scan also found 0 vulnerabilities in packages you import and 5
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.

[ties]

I think this is a good safeguard, let's add it.