Arseny Pinigin - Feature/lab9

[Hidancloud]

Goal

Complete Lab 9 DevSecOps work: scan QuickNotes with Trivy and ZAP, triage findings, fix security issues in code, and add a govulncheck CI gate.

Changes

• Added Trivy scan artifacts, CycloneDX SBOM, and full HIGH/CRITICAL triage in submissions/lab9.md.
• Added OWASP ZAP before/after reports and fixed security header findings with router-level middleware.
• Added regression tests to ensure security headers are applied across routes.
• Upgraded the Docker builder to patched Go 1.26.4 and added a Dockerfile HEALTHCHECK.
• Added a pinned govulncheck CI job and included red/green workflow evidence screenshots.
• Documented design analysis for Trivy, ZAP, SBOM, and govulncheck tradeoffs.

Testing

• go test -race -count=1 ./...
• go vet ./...
• govulncheck ./...
• golangci-lint run
• Trivy image/fs/config scans with aquasec/trivy:0.59.1
• ZAP baseline scans with ghcr.io/zaproxy/zaproxy:2.16.1
• GitHub Actions green run: test, lint, vet, govulncheck

Checklist

• Title is a clear sentence (≤ 70 chars)
• Commits are signed (git log --show-signature)
• submissions/lab9.md updated