[security] audit repository tooling

[dashpole]

Even though this repository isn't in the OTel github organization, we should still try to follow best practices used by the rest of the go community: open-telemetry/opentelemetry-go#4459.

We should look at the list of recommendations, determine what we need to change, and make updates to this repository if possible.

• CodeQL enabled via GitHub Actions
• Static code analysis tool (the collector uses govulncheck [https://pkg.go.dev/golang.org/x/vuln] on every build)
• Repository security settings
  • Security Policy ✅
  • Security advisories ✅
  • Private vulnerability reporting ✅
  • Dependabot alerts ✅
  • Code scanning alerts ✅

[aabmass]

David to look into this next sprint

[dashpole]

codeql is not using github actions. I need to look into that.