fix: govulncheck, semgrep & ruleguard scan/fixes

[caarlos0]

• added govulnscan
• added semgrep
• added ruleguard
• improved some matrix configs
• using setup-go's cache option directly

[codecov]

Codecov Report

Merging #544 (9623ee8) into main (437d9ef) will increase coverage by 0.09%.
The diff coverage is 50.00%.

@@            Coverage Diff             @@
##             main     #544      +/-   ##
==========================================
+ Coverage   65.88%   65.98%   +0.09%     
==========================================
  Files          16       16              
  Lines        1996     1993       -3     
==========================================
  Hits         1315     1315              
+ Misses        535      533       -2     
+ Partials      146      145       -1     

Impacted Files	Coverage Δ
deb/deb.go	71.42% <0.00%> (ø)
nfpm.go	86.88% <0.00%> (ø)
apk/apk.go	72.54% <100.00%> (+0.62%)	⬆️
internal/glob/glob.go	83.60% <100.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.