Add govulncheck CI and Dependabot for the two Go modules, src/webui
and src/netbrowse, so vendored dependencies don't quietly accumulate
CVEs between manual updates.
The workflow reports every finding in the run summary but only fails
on vulnerabilities our code actually calls in a dependency. Called
stdlib vulnerabilities are surfaced too, but they're fixed by bumping
the Buildroot host Go rather than a module's go.mod, so they don't
gate the build.
Dependabot ignores openconfig/goyang: it's pinned to our kernelkit
fork via a replace directive and stepped by hand.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
