fix(ci): disable govulncheck internal checkout to prevent auth conflict

The govulncheck-action uses an older internal actions/[email protected]
that creates duplicate Authorization headers when the repo is already
checked out, causing HTTP 400 errors. Setting repo-checkout: false
skips the redundant checkout since we already check out the code.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: pacphi

.github/workflows/security.yml

@@ -37,6 +37,7 @@ jobs:
       with:
         go-version-input: 1.24
         go-package: ./...
+        repo-checkout: false
 
     - name: Run Nancy vulnerability scanner for Go modules
       run: |