Run govulncheck daily to alert us to vulnerabilities in the main branch

[wallrj]

Run govulncheck at midnight every night on the main branch to alert us to recent vulnerabilities which affect the Go code in this project.

For example, this would have alerted us to the vulnerabilities in the Go 1.21.7 which were fixed in Go 1.21.8.
The badge would have turned red and GitHub notifications would have been received by maintainers who are subscribed to this project.
The output of the failed action would have looked like:

Running 'GOTOOLCHAIN=go1.21.7 _bin/tools/govulncheck ./...' in directory '.'
Scanning your code and 1172 packages across 104 dependent modules for known vulnerabilities...

=== Symbol Results ===

Vulnerability #1: GO-2024-2610
    Errors returned from JSON marshaling may break template escaping in
    html/template
  More info: https://pkg.go.dev/vuln/GO-2024-2610
  Standard library
    Found in: html/template@go1.21.7
    Fixed in: html/template@go1.21.8
    Example traces found:
      #1: test/env/env.go:73:24: env.RunControlPlane calls envtest.Environment.Start, which eventually calls template.Template.Execute
      #2: test/env/env.go:90:63: env.RunControlPlane calls webhook.StartWebhookServer, which eventually calls template.Template.ExecuteTemplate

Depends on the make verify-govulncheck target which was added to makefile_modules in cert-manager/makefile-modules#90:

• Add a make verify-govulncheck target makefile-modules#90

Testing

I've tested the new workflow by updating the default branch of my fork and triggering it there, as explained by @jsoref in https://github.com/orgs/community/discussions/25746.
Here are the results:

• https://github.com/wallrj/approver-policy/actions/runs/8281943496

And here's what the new badge in the README file should look like:

[inteon]

I do not know if GH actions is better vs prow.
The badge seems to be an advantage of GH actions.
We can still move if there are any issues.
/approve
/lgtm

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: inteon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [inteon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment