feat: upgrade to Go 1.25.10 and add Trivy & Govulncheck security scans

[dushimsam]

…

[greptile-apps]

Greptile Summary

This PR upgrades the project to Go 1.25.10 and bolts two new security scanning gates onto the PR validation workflow: a Trivy filesystem SCA scan (blocking on CRITICAL/HIGH unfixed CVEs) and a govulncheck step that traces known vulnerabilities through the actual call graph.

• Go upgrade: go-version in CI, GO_VERSION in the Makefile, and a new toolchain go1.25.10 directive in go.mod are all updated consistently; the go 1.25 minimum-version line is kept, which is correct Go module semantics.
• CI hardening: permissions: contents: read and explicit types triggers are added to the workflow, and a companion scripts/security-scan.sh provides the same two scans for local developer use with graceful tool-not-found messaging.

Confidence Score: 5/5

Safe to merge — changes are additive CI/security tooling with no modifications to application logic.

The Go version bump, toolchain directive, and new scanning steps are all consistent with each other and with the rest of the repo. The security-scan.sh script is a local utility that accumulates exit codes correctly. No application code is touched.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/pr.yml	Adds Trivy SCA and Govulncheck steps, pins Go to 1.25.10, tightens PR event triggers, and adds contents: read least-privilege permissions.
Makefile	Bumps GO_VERSION from 1.24.3 to 1.25.10 and adds a security-scan target that delegates to the new shell script.
go.mod	Adds toolchain go1.25.10 directive alongside the existing go 1.25 minimum version line; correct Go 1.21+ semantics.
scripts/security-scan.sh	New local dev script that discovers Trivy and govulncheck, runs both scans, and aggregates exit codes so all failures are reported before exiting.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
.github/workflows/pr.yml:26-27
The two new security-scanning actions are pinned to mutable version tags (`0.35.0` and `v1.0.4`). Tags can be force-pushed, so a compromised upstream repo could silently replace the tag's target commit and inject malicious code into the workflow without any diff being visible here. Pinning to the immutable SHA digest prevents this. The existing actions in this file follow the same mutable-tag pattern, so updating all of them at once would be the cleanest fix.

```suggestion
      - name: Run Trivy Vulnerability Scanner (SCA)
        uses: aquasecurity/trivy-action@915ce7f4e1d4e55b17e29e75c47b37d9ff2be2ae  # v0.35.0
```

_{Reviews (2): Last reviewed commit: "feat: upgrade to Go 1.25.10 and integrat..." | Re-trigger Greptile}

[dushimsam]

@greptile