Replace Dependabot gomod with govulncheck and test-against-latest
Dependabot's Go dependency PRs are high-noise, low-signal -- most
bumps are transitive deps with CVEs we don't even call, and every PR
fights the merge queue over go.sum conflicts.
Replace with two scheduled workflows:
- govulncheck: symbol-level vuln scanning (daily + on push/PR)
- go-latest-deps: test suite against latest deps (daily, informational)
Go deps get updated on our schedule now, not each dependency's.
