Run govulncheck in CI and release

[machado144]

Summary

• add a Makefile vuln target that runs govulncheck ./...
• install and run govulncheck in the CI workflow
• install and run govulncheck in the release workflow before tagging/releasing
• include the vuln target in make release-check

Notes

• current local dist/pipekit size: 15,724,728 bytes, shown by ls -lh as 15M
• the release run triggered before this PR completed successfully, but it did not include govulncheck yet; future release runs will after this merges

Tests

• go test ./...
• make vuln