Configure application security policy in CI

[smlx]

Partially addresses #360.

Once this is merged, we can enable Dependabot at which point #360 can be closed.

[shreddedbacon]

I've addressed all the go lint complaints now. Will leave the action stuff for someone else to address.

[smlx]

If it is easier, this can be merged without the actions changes for now. None of the checks are required - just advisory. Then at a later stage once the issues are fixed the checks can be enforced.

[shreddedbacon]

If it is easier, this can be merged without the actions changes for now. None of the checks are required - just advisory. Then at a later stage once the issues are fixed the checks can be enforced.

I think just the idea of it having a constant red failure that is an advisory will still irk me. I'm happy to wait a bit to see if someone else can address the actions stuff before it annoys me too much.

[tobybellwood]

I've disabled shellcheck on actions - it's very needy! We can always work on it in the background.

[tobybellwood]

Happy to get this in place - and tweak as may be necessary!