fix(security): resolve gosec findings keeping Security Scanning red on main

[cristim]

With govulncheck (#1343) and npm audit (#1345) now green, the Security Scanning job's remaining failure is the gosec static-analysis step. Likely pre-existing gosec debt newly surfaced (earlier steps used to fail first). Run gosec ./... per the CI job config, triage each finding (real vuln vs false positive), fix real ones, and justify suppressions individually with #nosec + reason (no blanket excludes). Part of the main-CI-green effort alongside #1342 (Lint).

[cristim]

Resolved by #1363 (merged): Security Scanning is green on main with all 6 Go modules scanned by pinned gosec v2.26.1. Recommend closing.

[cristim]

Verification sweep against main (101f099fb) on 2026-07-27 finds this already resolved.
Security Scanning is green on main, with gosec pinned at v2.28.0 running across all 6 modules and the codebase carrying 80 #nosec Gxxx annotations in the form standalone gosec honors.
Evidence: commits 4193ecc, 744b42a, 8cd51ab (PR #1384); main runs 30296156256 and 30292972151 both green.
Recommending close. Reopen if further gosec debt resurfaces.

[cristim]

Verified resolved at 3c0f8ac: the Security Scanning job runs a pinned gosec v2.28.0 across all six Go modules and is green on main (run 33392508823 at this commit). Evidence: .github/workflows/ci.yml:676 (#1363, #1384). Residual axes checked: govulncheck step in the same job also passes; the per-module loop covers pkg, providers/aws, providers/azure, providers/gcp and tests/e2e. Closing as completed; reopen if the behaviour recurs.