…#4605)

## Why

The `govulncheck-analysis` job (non-blocking SARIF upload) only scanned
core packages. Contrib module vulnerabilities were caught by
`govulncheck-tests` (blocking, sandboxed) but never appeared in the
GitHub Security tab / Code Scanning. This created a gap: a contrib CVE
would fail the PR check but leave no trace in the Security dashboard.

This PR closes that gap by adding a parallel non-blocking
`govulncheck-contribs-analysis` job that scans every contrib module and
uploads results to GitHub Code Scanning.

## What

- **New script**: `govulncheck-contribs-sarif.sh` — mirrors
`govulncheck-contribs-v2.sh` but uses `-format sarif`. It scans each
contrib module, writes a per-module SARIF file to a temp directory, then
merges all runs into a single output file via `jq`.
- **New job**: `govulncheck-contribs-analysis` — sets up Go, installs
govulncheck, runs the script, and uploads the merged SARIF under the
`govulncheck-contribs` category.
- **Updated comment** in `govulncheck-analysis`: replaces the `TODO`
with a reference to the new job.
- **Updated `paths` filter**: adds `govulncheck-contribs-sarif.sh` so
changes to the script trigger the workflow.

## Design decisions

**Why merge SARIF with `jq` instead of uploading per-module files?**
The `upload-sarif` action accepts a directory, but uploading N files
(one per contrib module) would create N separate tool runs in Code
Scanning, making the Security tab noisy. Merging runs into one SARIF
file keeps results grouped under a single `govulncheck-contribs`
category.

**Why not sandbox this job?**
The `govulncheck-contribs-analysis` job is non-blocking and
informational, consistent with `govulncheck-analysis`. The sandboxed
`govulncheck-tests` job provides the security boundary for blocking
checks.

## Stack

This PR is part of a stack:

```
main
 └── #4595 kakkoyun/govulncheck (base)
      └── #4597 kakkoyun/govulncheck-persist-credentials
           └── #4598 kakkoyun/govulncheck-sandboxed-step
                └── #4599 kakkoyun/govulncheck-action-allowlist
                     └── this PR kakkoyun/govulncheck-contrib-sarif
```

Merge order: #4595 → #4597 → #4598 → #4599 → this PR.

## Test plan

- [ ] CI passes on this branch (all three jobs green)
- [ ] `govulncheck-contribs-analysis` job appears in the Actions run
- [ ] SARIF upload succeeds (check `upload-sarif` step output)
- [ ] GitHub Security tab shows findings under `govulncheck-contribs`
category after merge to main

### What does this PR do?

Runs the highest-risk dependency/toolchain CI paths inside [`geomys/sandboxed-step`](https://github.com/geomys/sandboxed-step), pinned to `v1.2.1`'s immutable SHA for the repo's SHA-pinning policy.

Concretely, this PR:

- wraps blocking govulncheck execution in a gVisor sandbox
- adds sandboxed contrib-module SARIF generation for GitHub Code Scanning
- keeps the official `golang/govulncheck-action` for core SARIF analysis from #4599
- wraps smoke-test `go get -u` / requested `go-libddwaf` dependency upgrade compilation in a sandbox
- wraps contrib smoke tests that run `go get -u` before tests in a sandbox
- wraps gotip testing, where CI downloads and runs the latest Go toolchain, in a sandbox
- restores/cleans workspaces after sandboxed steps before any upload/token-consuming follow-up steps, preserving only required reports, coverage, or SARIF artifacts

### Motivation

`go get -u`, `go install ...@latest`, `gotip download`, and govulncheck all intentionally pull and execute code from outside this repository. That is exactly the class of CI work where sandboxing helps: it strips most of the ambient authority that a GitHub-hosted runner otherwise gives to dependency code.

This builds on the checkout hardening already in the workflows (`persist-credentials: false`) by also isolating the execution environment with gVisor.

### Notes on implementation

- `geomys/sandboxed-step` is pinned by commit SHA because this repository has `sha_pinning_required: true` for GitHub Actions.
- Steps that need artifacts after sandbox execution use `persist-workspace-changes: 'true'`, then immediately run `git reset --hard` and `git clean -fdx` with narrow exclusions for the required output files.
- Govulncheck tools are installed into `${GITHUB_WORKSPACE}/bin` inside the sandbox so subsequent commands in the same sandboxed step can find them on `PATH`.

### Validation

Local:

- `make lint/action`
- `make -C .github/workflows test-apps.yml && git diff --exit-code -- .github/workflows/test-apps.yml`
- `bash -n scripts/ci_test_contrib.sh scripts/ci_test_core.sh scripts/install_tools.sh scripts/lint.sh`
- `git diff --check`
- YAML parse checks with `yq`

CI/manual runs:

- Manual **Govulncheck** run passed after verifying sandbox logs, SARIF preservation, and Code Scanning upload.
- Manual **Smoke Tests** run passed, including sandboxed updated-dependency compile and sandboxed `go get -u` contrib smoke jobs.
- Manual **Gotip Testing** run passed, including sandboxed gotip download/test execution.
- Latest PR GitHub checks show no failures; only external GitLab benchmark/mergegate aggregate checks were still pending at last inspection.

### References

- [geomys/sandboxed-step](https://github.com/geomys/sandboxed-step)
- [gVisor](https://gvisor.dev/)
- [Filippo Valsorda: Turn Dependabot Off](https://words.filippo.io/dependabot/) — CI sandboxing discussion
- [PR #4595](#4595) — govulncheck workflow foundation
- [PR #4599](#4599) — official govulncheck-action SARIF analysis

### Reviewer's Checklist

- [x] N/A — CI/workflow-only change, no Go code modified


Co-authored-by: darccio <[email protected]>