ci: add nancy

[jeinfeldt]

Hello,

we would benefit from using Nancy to check our dependencies.
@tessig opened a PR for this previously #69
before go.mod was fully supported.

Since flamingo does not use travis anymore for CI, lets try with github actions.
Workflow suggested by: https://github.com/marketplace/actions/nancy-for-github-actions

For now I would suggest to only do this on PR, as we would otherwise break the CI on master.
After all vulnerabilities are fixed, we can adjust the behaviour.
Of course we can discuss how to integrate this workflow / naming things.

The current vulnerability is related to
spf13/viper#957

If we decide to merge this closes #69

[carstendietrich]

We could move this to the Static checks part, and we should have a look at https://docs.github.com/en/actions/reference/events-that-trigger-workflows#scheduled-events to run the dependency check on a daily basis..

[carstendietrich]

@jeinfeldt please check the scheduled trigger and try to do a go get on etcd to override the vuln dependency

[tessig]

very nice, thanks!