ci: derive Go version from go.mod in security workflow

[Copilot]

The Security Scanning workflow had a hard-coded Go patch version (1.25.7), requiring a separate workflow edit every time go.mod is updated — and creating drift risk where govulncheck runs against a different Go version than the module declares.

Changes

• .github/workflows/security.yml: Replace go-version: '1.25.7' with go-version-file: go.mod in the actions/setup-go@v6 step, making go.mod the single source of truth.

# Before
- name: Setup Go
  uses: actions/setup-go@v6
  with:
    go-version: '1.25.7'

# After
- name: Setup Go
  uses: actions/setup-go@v6
  with:
    go-version-file: go.mod

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.