ci: check both Go modules with govulncheck (#2729)
Add a standalone GitHub Actions workflow that runs `govulncheck ./...`
for both the root and Caddy Go modules.
- Reuse the existing Go, PHP and watcher setup and CI build tags.
- Run on pull requests, pushes to `main`, daily and on manual dispatch.
- Keep the change limited to the workflow, with no helper scripts,
documentation or Dependabot changes.
Validation: actionlint, YAML and shell syntax checks passed. The actual
scan still needs to run in GitHub Actions.
@dunglas CC
Co-authored-by: Tim Nelles <tim.nelles@denkwerk.com>
