fix: remediate reachable Go vulnerabilities

[cmilesio]

What

Fix vulnerable dependency paths and apply the same security controls to all 12 Queue modules.

Area	Change
PostgreSQL and MySQL	Select patched pgx, text, and Edwards25519 releases
NATS and RabbitMQ	Select x/crypto 0.56, compress 1.18.7, and AMQP 1.13.0
Integration graph	Select patched Moby archive and OpenTelemetry releases
Module coverage	Discover and scan all 12 Go modules, with shared version updates grouped by dependency name
Code scanning	Use organization-managed CodeQL across all Go source
Vulnerability scanning	Fail on module discovery, scanner errors, and unexpected reachable findings
SBOMs	Produce 12 canonical CycloneDX JSON library inventories
Workflow integrity	Pin every action to its immutable commit and keep restore-only cache semantics

The examples dependency catalog remains intact because overlay tests compile build-tagged examples through its local replacements. The generated integration-test evidence is refreshed against the final module inputs. All modules already require Go 1.27, so these dependency updates do not increase the minimum toolchain. No Queue API, configuration, or stored-data format changes.

Why

The updates prevent dependency resolution from reintroducing known SQL, archive, messaging, crypto, and telemetry advisories. Dynamic workflow coverage ensures a new driver module cannot silently miss govulncheck, SBOM, or Dependabot protection.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.