Add weekly govulncheck workflow

[lentzi90]

What this PR does / why we need it:

This adds a github workflow for weekly security scanning using govulncheck. It was inspired by what CAPI has but adapted quite heavily and limited to govulncheck for now. (CAPI also runs Trivy to scan the images.)
I have been doing the same in CAPO and ORC with the goal of having better insights into when new patch releases would be needed to fix vulnerabilities (and of course when dependencies need to be updated).

Which issue this PR fixes(if applicable):
fixes #

Special notes for reviewers:

Release note:

NONE

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign zetaab for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kayrus]

@lentzi90 thanks for the PR. See my updates in comments

[kayrus]

why don't use the tag?

Suggested change

	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
	uses: actions/[email protected]

[lentzi90]

Higher level of paranoia I guess 😅
I copied from CAPI and Metal3, where we use hashes since they are guaranteed to never change. The tag on the other hand can be overwritten.

[lentzi90]

Thanks for the comments, I have updated and addressed them 🙂