Backport of [NET-6969] security: Re-enable Go Module + secrets security scans for release branches into release/1.17.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #19978 to be assessed for backporting due to the inclusion of the label backport/1.17.

The below text is copied from the body of the original PR.

---

Description

• Re-enable binary Go Modules + secrets security scans to block releases automatically in CRT on failure
  • Previously disabled in the following PRs; all prior issues appear to now be resolved:
    • Turn off sec-scanner check #13614
    • Update security scanner logic #12281
    • Fix Security Scan #12275
  • I also re-enabled secrets in the container scans because that seemed like an obvious opportunity
• Introduce PR and merge scans of the repository on main and release/** branches
  • The goal here is to increase visibility of un-triaged scan results before they block a release; doing so requires scanning more than our nightly run on main.
  • Note that this will result in a one-time increase of new items to triage for the scanned release branches, where scanning was not already done manually. Once we triage the initial set, we just need to maintain it going forward.

Reviewer Notes

• Security folks: I'd love your input on anything here that seems missing or non-standard. My goal isn't to flip every bit on, so much as to keep up with our expected baseline that was previously disabled, and ensure we're catching things early pre-release. If there are better ways to do that, or specific flags that should be added beyond what's being re-enabled, all ears.
• Consul eng: any concerns or Q&A about this change are welcome. Beyond that, this PR should be pretty straightforward to review.

Testing & Reproduction steps

• Repo scan and SARIF upload for test branch verified here: https://github.com/hashicorp/consul/actions/runs/7190530738/job/19583818068
• For the binary + container scan, I've verified that this would not block a release today once enabled:

❯ go version $(which consul)
/Users/michael.zalimeni/go/bin/consul: go1.20.12

❯ SECURITY_SCANNER_CONFIG_FILE=.release/security-scan.hcl scan container hashicorp/consul-enterprise:local
✓ Scanned docker:{owner:"hashicorp" name:"consul-enterprise"} tag:"local" localDaemon:true in 1m4.3s - no results found

❯ consul version | grep Consul
Consul v1.18.0-dev+ent
❯ SECURITY_SCANNER_CONFIG_FILE=.release/security-scan.hcl scan binary $(which consul)
✓ Scanned file:{path:"/Users/michael.zalimeni/go/bin/consul"} in 10.5s - no results found

❯ consul version | grep Consul
Consul v1.17.2-dev+ent
❯ SECURITY_SCANNER_CONFIG_FILE=.release/security-scan.hcl scan binary $(which consul)
✓ Scanned file:{path:"/Users/michael.zalimeni/go/bin/consul"} in 10.3s - no results found

❯ consul version | grep Consul
Consul v1.16.5-dev+ent
❯ SECURITY_SCANNER_CONFIG_FILE=.release/security-scan.hcl scan binary $(which consul)
✓ Scanned file:{path:"/Users/michael.zalimeni/go/bin/consul"} in 13.1s - no results found

❯ consul version | grep Consul
Consul v1.15.9-dev+ent
❯ SECURITY_SCANNER_CONFIG_FILE=.release/security-scan.hcl scan binary $(which consul)
✓ Scanned file:{path:"/Users/michael.zalimeni/go/bin/consul"} in 11.6s - no results found

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern 🔒

---

Overview of commits

• 63030c8 - f40a132

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR