Enable gosec for SAST scans

[vpnachev]

What this PR does / why we need it:
Enable gosec for SAST scans

Which issue(s) this PR fixes:
Fixes #164

Special notes for your reviewer:

Release note:

`gosec` is made available for SAST(static application security testing), it can be run with `make sast` or `make sast-report`. 

[gardener-robot-ci-2]

This PR proposes changes that would break the pipeline definition:

oidc-webhook-authenticator-enable-sast: Traceback (most recent call last):
  File "/usr/lib/python3.12/site-packages/concourse/replicator.py", line 141, in render
    definition_descriptor = self._render(definition_descriptor)
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/concourse/replicator.py", line 185, in _render
    'definition': factory.create_pipeline_definition(),
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/concourse/factory.py", line 88, in create_pipeline_definition
    self._apply_traits(variant)
  File "/usr/lib/python3.12/site-packages/concourse/factory.py", line 177, in _apply_traits
    transformer.process_pipeline_args(pipeline_def)
  File "/usr/lib/python3.12/site-packages/concourse/model/traits/release.py", line 505, in process_pipeline_args
    raise ValueError(f'{asset=}\'s step_name refers to an absent build-step')
ValueError: asset=BuildstepLogAsset(ocm_labels=[{'name': 'gardener.cloud/purposes', 'value': ['lint', 'sast', 'gosec']}, {'name': 'gardener.cloud/comment', 'value': 'We use gosec (linter) for SAST scans, see: https://github.com/securego/gosec.\nEnabled by https://github.com/gardener/oidc-webhook-authenticator/pull/165\n'}], type='build-step-log', name='verify-build-step-log', step_name='verify', artefact_type='application/data', artefact_extra_id={}, purposes=['lint', 'sast', 'gosec'], comment='We use gosec (linter) for SAST scans, see: https://github.com/securego/gosec.\nEnabled by https://github.com/gardener/oidc-webhook-authenticator/pull/165\n')'s step_name refers to an absent build-step

[dimityrmirchev]

Thanks!

/lgtm

[dimityrmirchev]

The check step fails, I guess we should exclude he gosec linter from golangci-lint

[gardener-robot-ci-2]

This PR proposes changes that would break the pipeline definition:

oidc-webhook-authenticator-enable-sast: Traceback (most recent call last):
  File "/usr/lib/python3.12/site-packages/concourse/replicator.py", line 141, in render
    definition_descriptor = self._render(definition_descriptor)
                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/concourse/replicator.py", line 185, in _render
    'definition': factory.create_pipeline_definition(),
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.12/site-packages/concourse/factory.py", line 88, in create_pipeline_definition
    self._apply_traits(variant)
  File "/usr/lib/python3.12/site-packages/concourse/factory.py", line 177, in _apply_traits
    transformer.process_pipeline_args(pipeline_def)
  File "/usr/lib/python3.12/site-packages/concourse/model/traits/release.py", line 505, in process_pipeline_args
    raise ValueError(f'{asset=}\'s step_name refers to an absent build-step')
ValueError: asset=BuildstepLogAsset(ocm_labels=[{'name': 'gardener.cloud/purposes', 'value': ['lint', 'sast', 'gosec']}, {'name': 'gardener.cloud/comment', 'value': 'We use gosec (linter) for SAST scans, see: https://github.com/securego/gosec.\nEnabled by https://github.com/gardener/oidc-webhook-authenticator/pull/165\n'}], type='build-step-log', name='verify-build-step-log', step_name='verify', artefact_type='application/data', artefact_extra_id={}, purposes=['lint', 'sast', 'gosec'], comment='We use gosec (linter) for SAST scans, see: https://github.com/securego/gosec.\nEnabled by https://github.com/gardener/oidc-webhook-authenticator/pull/165\n')'s step_name refers to an absent build-step

[dimityrmirchev]

/lgtm