chore(lint): enable gosec (#7792)

Enable "gosec" linter.

Exclude:

- All G115 (integer overflow) findings, to be fixed separately.

Add targeted gosec annotations for:

- non-crypto math/rand usage
- md5 used only for file change detection
- G114 ("net/http serve with no timeout settings"), to be fixed
  separately.

Other findings fixed.

Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>

plugin/pkg/tls/tls.go

@@ -95,7 +95,11 @@ func NewTLSConfig(certPath, keyPath, caPath string) (*tls.Config, error) {
 		return nil, err
 	}
 
-	tlsConfig := &tls.Config{Certificates: []tls.Certificate{cert}, RootCAs: roots}
+	// #nosec G402 -- MinVersion and MaxVersion are set in setTLSDefaults
+	tlsConfig := &tls.Config{
+		Certificates: []tls.Certificate{cert},
+		RootCAs:      roots,
+	}
 	setTLSDefaults(tlsConfig)
 
 	return tlsConfig, nil
@@ -109,7 +113,10 @@ func NewTLSClientConfig(caPath string) (*tls.Config, error) {
 		return nil, err
 	}
 
-	tlsConfig := &tls.Config{RootCAs: roots}
+	// #nosec G402 -- MinVersion and MaxVersion are set in setTLSDefaults
+	tlsConfig := &tls.Config{
+		RootCAs: roots,
+	}
 	setTLSDefaults(tlsConfig)
 
 	return tlsConfig, nil