ci: bump gosec pin to latest v2.27.x and retire obsolete #nosec suppressions

[cristim]

Follow-up to #1363 (owner suggestion). The gosec binary version, not the GitHub action wrapper, decides findings. Newer gosec (v2.27.x) has materially better G115 bounds-check recognition and improved G304 analysis, so a number of the current rule-specific #nosec annotations (added next to real guards) should no longer be needed.

Scope: bump the pinned version in .github/workflows/ci.yml (and scripts/gosec-hook.sh from #1376 - keep both pins identical); re-scan all 6 Go modules; REMOVE every #nosec the new version no longer requires (verify each by temporarily removing it and re-scanning); KEEP the genuinely-intentional ones (G101 env-var-name/constant false positives, TOTP SHA-1 compat) with their justifications - those are audit trail, not debt. Zero behavior changes to production code; suppress-count strictly decreases. Per feedback_gosec_nosec_not_nolint + no-masking directive.

[cristim]

PR #1384 implements this: #1384

Bumped gosec to v2.28.0 and audited all #nosec annotations across the repo. Results:

• 10 annotations retired/cleaned (9 full removals, 1 partial label cleanup)
• ~69 annotations kept (findings still return with v2.28.0)

Key retirements: 6x G201 (SQL format string -- rule removed from gosec v2.28.0), 2x G101 in email templates, 1x G101 for azure_client_secret constant, and G122 removed from one G304,G122 pair (G122 not recognized by v2.28.0).

All 6 modules pass gosec with 0 findings; go build, go vet, and go test all clean.