v3.6.1

Full Changelog

Added:

• Added a global --timeout flag to bound Dropbox network operations (e.g. --timeout 30s; 0 disables).
• Threaded context.Context through all Dropbox API calls so operations respect cancellation and deadlines.

Changed:

• put now preserves the source file's modification time as ClientModified instead of the upload time (stdin uploads use the spool file mtime).
• The retry loop now respects context cancellation during backoff and never retries context errors.

Infrastructure:

• Added scheduled/manual OSSF Scorecard scanning without public Scorecard API publishing.
• Replaced standalone Staticcheck workflow steps with a narrow golangci-lint configuration.
• Added explicit go.sum cache dependency paths for actions/setup-go.
• Added race detector, workflow linting, and CodeQL security scanning to CI.
• Hardened CI workflows with explicit read-only permissions.
• Generate a non-constant OAuth2 state value to resolve the CodeQL go/constant-oauth2-state alert.