ci: check both Go modules with govulncheck

[opctim]

Add a standalone GitHub Actions workflow that runs govulncheck ./... for both the root and Caddy Go modules.

• Reuse the existing Go, PHP and watcher setup and CI build tags.
• Run on pull requests, pushes to main, daily and on manual dispatch.
• Keep the change limited to the workflow, with no helper scripts, documentation or Dependabot changes.

Validation: actionlint, YAML and shell syntax checks passed. The actual scan still needs to run in GitHub Actions.

@dunglas CC