Create govulncheck.yml

[fxamacker]

Add a GitHub Actions workflow to run govulncheck.
According to govulncheck docs:

"Govulncheck reports known vulnerabilities that affect Go code. 
It uses static analysis of source code or a binary's symbol table 
to narrow down reports to only those that could affect the application.

By default, govulncheck makes requests to the Go vulnerability database
at https://vuln.go.dev. Requests to the vulnerability database contain only
module paths, not code or other properties of your program."

[fxamacker]

@x448 can you take a look to see if I missed anything? 🙏

[x448]

Nice find. 👍

Not a big fan of downloading and running govulncheck without verifying hash of the downloaded file. Maybe do that once they tag a release or two. 🤷

[fxamacker]

I forgot to squash so it's messy but I don't want to do a force push to cleanup.