lint: enable 14 new linters, bump golangci-lint-action to v9.3.0

[dgageot]

Keeping the linter configuration up-to-date catches more bugs statically and reduces review noise over time. This commit enables 14 linters that were available but not yet turned on, and bumps the CI action that runs them.

The new linters cover a broad range of concerns: duplicate words in comments (dupword), misused embedded struct fields (embeddedstructfieldcheck), JSON error-checking gaps (errchkjson), incomplete switch/select coverage (exhaustive), unchecked type assertions (forcetypeassert), comment punctuation (godot), security patterns (gosec), interface ambiguities (iface), nil-return bugs (nilerr, nilnesserr, nilnil), incorrectly constructed host:port strings (nosprintfhostport), receiver inconsistencies (recvcheck), and missing t.Parallel() calls in subtests (tparallel). gosec required a small set of targeted //nolint exclusions: G103 covers the deliberate unsafe zero-copy in FindBytes/ContainsBytes (documented at the call sites), G115 covers integer conversions that are bounds-checked by construction, and G304 covers the scanner's intentional opening of user-supplied paths. gosec is also suppressed on _test.go files because tests hardcode fake credentials by design. Two candidates — makezero and prealloc — were evaluated but dropped because every finding was a false positive on intentionally index-filled slices. golangci-lint-action is bumped from v9.2.0 to v9.3.0 (SHA-pinned); the linter binary itself was already at the latest v2.12.2 and needed no change.

No production behaviour changes. The only code edits are the //nolint annotations that silence the three deliberate gosec patterns described above.