Make govulncheck run more reliable

[pjanotti]

Broken down the execution per packages, but, in the end that was not enough and had to change the scan scope to package. The main disadvantage of that is that with symbol the tool can better asses if the code uses a function or code pattern, with package scan we may have to do some follow up to understand if/how the vulnerability should be treated. This is not ideal, the alternative would be have some larger runner that could take the memory hit of the tool with the symbol scan.

Although the breakdown in packages was not enough I opted to keep it because it lowers the chances of more OOMs in the future and also make easier to run it locally when investigating issues. Similar to the changes on the Makefile: in the end it was not necessary to solve the problem, but, since it was already in place it is good to have it at hand.

Example run: https://github.com/signalfx/splunk-otel-collector/actions/runs/14010129646/job/39228876676?pr=6021

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[crobert-1]

I'm slightly concerned about more GitHub workflow code and scripts to maintain, but this seems like the best option with the flakiness. We can revisit later if it becomes challenging.

[pjanotti]

@crobert-1 just to be clear, we can really get rid of all of these by just setting the scan mode to be package instead of symbol which this PR had to do anyway to get reliable runs. Targeting the packages seem to be more about the future if the code base grows something that we should avoid if possible.