move "vet" checks from golangci-lint to nogo (#9671)

Nogo is `rules_go`'s way of linting go code. It runs during compilation,
and only during compilation. This means that lint results are cached
along with compiled libraries, so if a library isn't being compiled, you
don't have to spend time linting it.

Moving govet is the easiest linter. I plan to gradually chip away at
everything that golangci-lint does, but for now, we're just getting the
simplest one.

(Additionally, this makes bazel builds behave more like go builds. Go
runs vet whenever you request a test, and won't run the test if vet
fails. This doesn't happen with Bazel, but golangci-lint would have
gotten it. Now it works again, and also affects non-test targets, which
I think is helpful.)

We also gain the ability to write our own lint rules:
https://github.com/bazelbuild/rules_go/blob/master/go/nogo.rst#writing-and-registering-analyzers

.bazelversion

@@ -1 +1 @@
-7.0.0
+7.0.1

.golangci.yml

@@ -10,7 +10,6 @@ linters:
         - wrapcheck
         - nolintlint
         - gofmt
-        - govet
         - gosimple
         - errcheck
         - ineffassign

BUILD.bazel

@@ -1,6 +1,6 @@
 load("@buildifier_prebuilt//:rules.bzl", "buildifier", "buildifier_test", "buildozer_binary")
 load("@gazelle//:def.bzl", "gazelle")
-load("@rules_go//go:def.bzl", "go_library")
+load("@rules_go//go:def.bzl", "go_library", "nogo")
 
 licenses(["notice"])
 
@@ -71,6 +71,14 @@ config_setting(
 # gazelle:proto disable_global
 gazelle(name = "gazelle")
 
+# Configure nogo (a linter that runs next to the compiler).
+nogo(
+    name = "nogo",
+    config = "nogo.json",
+    vet = True,
+    visibility = ["//visibility:public"],  # must have public visibility
+)
+
 # Buildifier formats all BUILD files in the workspace.
 buildifier(
     name = "buildifier",

MODULE.bazel

@@ -7,13 +7,14 @@ bazel_dep(name = "aspect_bazel_lib", version = "2.1.0")  # Needed for arm64 jq a
 bazel_dep(name = "container_structure_test", version = "1.16.0")
 bazel_dep(name = "gazelle", version = "0.35.0")
 bazel_dep(name = "jsonnet_go", version = "0.20.0")
-bazel_dep(name = "rules_go", version = "0.44.1")
+bazel_dep(name = "rules_go", version = "0.45.1")
 bazel_dep(name = "rules_oci", version = "1.5.1")
 bazel_dep(name = "rules_python", version = "0.27.1")
 
 bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True)
 
 go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
+go_sdk.nogo(nogo = "//:nogo")
 go_sdk.download(
     name = "go_sdk",
     version = "1.21.5",