ci(pre-commit): bump gosec pin to v2.28.0 to match CI (#1384)

PR #1384 bumps the CI Security Scanning gosec pin to v2.28.0; align the
pre-commit hook so local and CI verdicts stay in agreement. Updates the
GOSEC_VERSION pin in scripts/gosec-hook.sh and the doc mentions in the
hook config comment.

Re-verified with v2.28.0: auto-install to the versioned cache dir works;
clean pass on cmd/ + pkg/ + providers/aws in ~1.6 s warm; deliberate G501
(crypto/md5) scratch file fails with exit 1; clean pass restored after
removal.

Author: cristim

.pre-commit-config.yaml

@@ -113,8 +113,8 @@ repos:
         # their owning module (root, pkg/, providers/aws, providers/azure,
         # providers/gcp).  Fast: never whole-repo, always per-changed-package.
         #
-        # gosec v2.26.1 is auto-installed to
-        # ~/.cache/pre-commit-gosec/v2.26.1/gosec on first use.
+        # gosec v2.28.0 is auto-installed to
+        # ~/.cache/pre-commit-gosec/v2.28.0/gosec on first use.
         #
         # Exclusion rationale and flag list live in scripts/gosec-hook.sh.
         # Keep in sync with the exclude= flags there.

scripts/gosec-hook.sh

@@ -5,8 +5,8 @@
 # files, resolved to their owning module.  Fast by design: never scans the whole
 # repo; each commit triggers at most one gosec invocation per affected module.
 #
-# Version pin: gosec v2.26.1 (matches the securego/gosec SHA pin in ci.yml).
-# Installed on first use to ~/.cache/pre-commit-gosec/v2.26.1/gosec; never
+# Version pin: gosec v2.28.0 (matches the CI pin in ci.yml, bumped by #1384).
+# Installed on first use to ~/.cache/pre-commit-gosec/v2.28.0/gosec; never
 # modifies the system-wide gosec binary.
 #
 # Called by pre-commit with pass_filenames: true and files: \.go$.
@@ -32,7 +32,7 @@
 
 set -euo pipefail
 
-GOSEC_VERSION="2.26.1"
+GOSEC_VERSION="2.28.0"
 GOSEC_BIN="${HOME}/.cache/pre-commit-gosec/v${GOSEC_VERSION}/gosec"
 
 GOSEC_EXCLUDE="G101,G104,G115,G117,G118,G122,G204,G301,G304,G402,G505,G702,G703,G705,G706"
@@ -51,7 +51,7 @@ ensure_gosec() {
         local installed_ver
         installed_ver=$(go version -m "$GOSEC_BIN" 2>/dev/null \
             | awk '$1=="mod" && $2~/gosec/{print $3}')
-        # installed_ver is e.g. "v2.26.1"; compare against "v$GOSEC_VERSION".
+        # installed_ver is e.g. "v2.28.0"; compare against "v$GOSEC_VERSION".
         if [[ "$installed_ver" != "v${GOSEC_VERSION}" ]]; then
             echo "pre-commit/gosec: cached binary is ${installed_ver:-unknown}, need v${GOSEC_VERSION}; reinstalling" >&2
             need_install=1