chore: add govulncheck security scanning to CI

[jflowers]

Summary

Add govulncheck to the CI pipeline to scan for known vulnerabilities in Go dependencies.

Context

Issue #15 identified that replicator has no security scanning CI step. The canonical reference (unbound-force/unbound-force) runs OSV-Scanner and Trivy source scans via ci_security.yml. At minimum, replicator should run govulncheck as part of CI.

Once a security scan check is present, the release preflight (being added in #15) can be extended to verify it passed before allowing a release.

Acceptance Criteria

• Add a govulncheck step to CI (either in ci.yml or a new ci_security.yml)
• CI fails if govulncheck finds known vulnerabilities in dependencies
• Document the check name so the release preflight can reference it in the future

References

• Parent issue: chore: add CI gate before release + pin action versions to commit SHAs #15
• Canonical reference: unbound-force/unbound-force/.github/workflows/ci_security.yml
• AGENTS.md mentions govulncheck under CI flags and linter configuration