ci(security): adopt reusable workflows from 2026-08-16

[sbaerlocher]

Summary

Picks up two fixes from arillso/.github#111:

• The CodeQL job comes back. security-code.yml had a concurrency group of bare ${{ github.workflow }}-${{ github.ref }}. Inside a workflow_call reusable those resolve to the caller, so the group was byte-identical to the one this workflow declares for itself, and with cancel-in-progress defaulting to true the job was dropped at scheduling time. That is why the nightly scan has reported failure since 2026-08-12 with every job it created green, no annotation and no log — the job never existed.
• Drops the hand-synced go-version literal. The reusable now takes a go-version-file input defaulting to go.mod, so the version no longer has to be repeated here and kept in sync by hand. That manual sync point is what let the Go 1.26.5 stdlib advisories sit unnoticed in the CodeQL job.

Test plan

• Ran this workflow on the branch before opening the PR (run 31979293143): codeql / Analyze Code (go) is created and executes, where on main it is absent from the jobs list entirely
• Run concludes success

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/nightly-security.yml

Package	Version	License	Issue Type
arillso/.github/.github/workflows/security-trivy.yml	2026-08-16	Null	Unknown License

Allowed Licenses:

Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MIT, 0BSD, CC0-1.0

OpenSSF Scorecard

Package	Version	Score	Details
actions/arillso/.github/.github/workflows/security-code.yml	2026-08-16	Unknown	Unknown
actions/arillso/.github/.github/workflows/security-secrets.yml	2026-08-16	Unknown	Unknown
actions/arillso/.github/.github/workflows/security-trivy.yml	2026-08-16	Unknown	Unknown

Scanned Files

• .github/workflows/nightly-security.yml

[claude]

No issues found.

The change is a clean, self-consistent maintenance update to .github/workflows/nightly-security.yml:

• All three reusable-workflow refs bump @2026-08-15 → @2026-08-16 consistently (no version skew).
• The explicit go-version: "1.26.6" input and its comment are removed from the codeql job. Removing the pin together with the comment that said the reusable workflow "only accepts a literal version, not a go-version-file" — in the same commit that bumps the reusable workflow tag — indicates security-code.yml@2026-08-16 now auto-detects the Go toolchain (e.g. from go.mod, which declares go 1.26.6).

Note: the arillso/.github reusable workflow at @2026-08-16 is not accessible from the review sandbox, so its default/detected Go version could not be independently confirmed. If that workflow does not read go.mod, please verify the nightly CodeQL Go extraction still builds against the 1.26.6 module directive.