ci: migrate workflows off retired GH_PAT secret, consolidate security scans

[ntlaletsi70]

What

Fixes CI, which has been failing on every PR (including the just-merged #98) with could not read Password for 'https://github.com': terminal prompts disabled — every workflow was still configured to authenticate private-module fetches with secrets.GH_PAT, a secret that no longer exists in this repo (retired when private-module auth migrated to a GitHub App). Also consolidates the two security-scanning workflows into one file.

Why

GH_PAT was removed as part of the earlier PAT→GitHub App auth migration (see #89 and the App setup that followed across environments, environments-api, environments-contract), but this repo's workflows were never updated to match — they were only fixed in environments' own CI. Confirmed via gh secret list that only APP_ID/APP_PRIVATE_KEY exist now.

• ci.yaml, security.yml (new): private-module git config now uses a short-lived GitHub App installation token via actions/create-github-app-token, minted fresh per job instead of a PAT whose expiry can silently lapse. Also added a go test + coverage step to ci.yaml — it previously only built/vetted/linted, so the domain/mediator/cache test suite from test: add unit test coverage for domains, mediators, and cache layers #98 would never actually run in CI.
• ko.yml, release.yml, security.yml (trivy-image): GHCR login switched to the default GITHUB_TOKEN — the App token is denied package writes/pulls against this org-scoped package regardless of granted permission, but GITHUB_TOKEN's repo-scoped access is exactly what a same-repo push/pull needs.
• create-release.yml, finalize-release.yml: switched to the App token (not GITHUB_TOKEN) since these push branches/tags/merges that must trigger downstream workflow runs (CI on the new release branch, the Release workflow on the new tag) — pushes authenticated with the default GITHUB_TOKEN don't trigger other workflows, but an App installation token does.

Merges gosec.yml + vulnscan.yml into a single security.yml (three jobs: gosec, govulncheck, trivy-image), each keeping its original trigger scope via a job-level if: gate — mirroring the consolidation already done in the environments library's own CI. Release-lifecycle workflows (release.yml, create-release.yml, finalize-release.yml, ko.yml) stay standalone, unchanged in structure.

Domain

• CI / tooling / docs

API impact

• No API surface change

Checklist

• mage verify passes locally (build/vet/gofmt clean; no mage target in this repo, ran the equivalent Go commands directly)
• buf breaking reviewed — n/a, no proto changes
• Panic-free resolution — unchanged
• Import paths use gen/go/blanketops/... for contract types — unchanged
• BlanketOps labels present where required — unchanged
• Conditions written via core.SetCondition — unchanged
• Events emitted via core.EventRecorder — unchanged
• ESP-0001 updated if contract semantics changed — n/a
• Commit messages follow Conventional Commits

Notes for reviewer

This should have been part of #98 — I pushed it right after opening that PR, but #98 was merged before I finished the CI fix. Only one new commit here (74c9758); everything else was already merged via #97/#98.