Enable gosec for static application security testing

[Kostov6]

How to categorize this PR?

/area compliance
/kind enhancement

What this PR does / why we need it:
This PR enables gosec following gardener/gardener-extension-shoot-lakom-service@0308023 and gardener/gardener-extension-shoot-lakom-service@61d3bd1

fixes #186

Release note:

`gosec` is made available for SAST(static application security testing), it can be run with `make sast` or `make sast-report`, but is also incorporated in the `verify` and `verify-extended` makefile targets. 

[plkokanov]

Suggested change

	# Gardener uses code-generators https://github.com/kubernetes/code-generator and https://github.com/protocolbuffers/protobuf
	# The shoot-rsyslog-relp extension uses code-generators https://github.com/kubernetes/code-generator and https://github.com/protocolbuffers/protobuf

[ialidzhikov]

Nit: We don't have protobuf in extensions.

[ialidzhikov]

But in general instead of copying this script file on make tidy we could call it directly from the hack dir of the Gardener the same way we call other scripts.

[plkokanov]

I'm ok to not copy it locally under hacks. I think it was done for other scripts so that they can be conveniently called from the hack directory as there is no make target for them.
Btw, It might be useful to extend the original script under g/g so that additional parameters can be passed to it - e.g. projects that depend on it might have additional directories that they want to exclude.

[ialidzhikov]

Btw, It might be useful to extend the original script under g/g so that additional parameters can be passed to it - e.g. projects that depend on it might have additional directories that they want to exclude.

Yep, we also want to exclude the gardener/ dir in the registry-cache repo. Ref gardener/gardener-extension-registry-cache#272 (comment)

[gardener-ci-robot]

The Gardener project currently lacks enough active contributors to adequately respond to all PRs.
This bot triages PRs according to the following rules:

• After 15d of inactivity, lifecycle/stale is applied
• After 15d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 7d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

• Mark this PR as fresh with /remove-lifecycle stale
• Mark this PR as rotten with /lifecycle rotten
• Close this PR with /close

/lifecycle stale

[ialidzhikov]

/remove-lifecycle stale

[plkokanov]

Generally /lgtm but we need to merge #196 first

[plkokanov]

/retest

[plkokanov]

/lgtm
/approve

[gardener-prow]

LGTM label has been added.

Git tree hash: 53dab23a8d9354066ca78e92277aafc41a59dfb6

[gardener-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: plkokanov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [plkokanov]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment