ci: add gosec security scanning

[mateeullahmalik]

Summary

Adds a fail-closed gosec security gate to Lumera CI.

The workflow:

• pins gosec to v2.29.0;
• runs on pull requests and pushes to master;
• scans all three Go modules independently:
  • chain root;
  • devnet;
  • tests/systemtests;
• blocks HIGH-severity, HIGH-confidence findings;
• also blocks scanner and package-analysis failures;
• uploads module-specific SARIF reports to GitHub Code Scanning;
• keeps scanning blocking when SARIF upload is unavailable on fork or Dependabot PRs;
• requires every #nosec suppression to name a rule and include a justification.

Why

A root-level gosec ./... does not cover Lumera's nested devnet and tests/systemtests modules. The matrix makes coverage explicit and prevents a green root scan from hiding unscanned code.

The devnet module also uses a local ../../sdk-go replacement. CI reproduces that layout with Lumera under workspace/lumera and sdk-go v1.2.0 commit b4fb54757fbe5431dfc08948a99881646f31036d under workspace/sdk-go.

Baseline handling

Five existing findings are intentional operator-controlled devnet trust boundaries. Each is suppressed at the sink with a rule-specific justification; no rule is excluded globally.

The test-only lumeraKeyType helper is moved into ibc_test.go so gosec can build the Hermes package's non-test SSA graph. The method body and test behavior are unchanged.

Validation

• actionlint .github/workflows/gosec.yml
• Clean-runner reproduction with the pinned sdk-go sibling checkout
• go mod download in all three modules
• HIGH/HIGH gosec scan in all three modules: zero findings and zero analysis errors
• Mutation probe: unsuppressed G703 produced SARIF and exited nonzero
• Analysis-error probe: malformed package analysis exited nonzero
• Nested-module SARIF path normalization and idempotency verified
• make install with installed/build binary SHA equality
• make unit-tests NOCACHE=1
• make integration-tests NOCACHE=1
• make test-scripts
• cd devnet && go test ./tests/common -count=1
• make system-tests NOCACHE=1
• make systemex-tests NOCACHE=1
• make lint
• git diff --check
• GitHub-hosted gosec (chain), gosec (devnet), and gosec (systemtests) jobs passed with real SARIF uploads

Risks

• New HIGH/HIGH findings or analysis failures will block PRs by design.
• Fork and Dependabot PRs cannot upload SARIF with their read-only tokens; scanning still runs and remains blocking.
• The pinned sdk-go commit must be updated deliberately if devnet starts using newer SDK APIs.

Rollback

Revert this PR. That removes the workflow and the five suppression comments. The test-helper relocation is behavior-neutral and can be reverted with the same change.

Migration and upgrade impact

None.

• No protobuf or state-key changes
• No keeper, ante-handler, or ABCI lifecycle changes
• No CheckTx, DeliverTx, BeginBlock, or EndBlock changes
• No migration or upgrade-handler changes
• Determinism and replay behavior are unchanged

Observability

SARIF findings appear in GitHub Code Scanning under distinct categories:

• gosec-chain
• gosec-devnet
• gosec-systemtests

The workflow also emits scanner output in GitHub Actions logs.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.