docs(lab9): add DevSecOps scans and security headers

[IlyaPechersky]

Goal

Submit Lab 9 requirements.

Changes

• Added securityHeaders middleware with unit tests for HTTP security headers
• Committed Trivy scan artifacts, CycloneDX SBOM, and ZAP baseline before/after reports
• Added govulncheck CI job pinned to v1.1.4
• Documented triage tables and design answers in submissions/lab9.md

Testing

• Ran Trivy image/fs/config scans and generated SBOM for quicknotes:lab6
• Ran ZAP baseline before and after the header fix; plugins 10021 and 90004 disappeared
• Verified go test -race ./... passes locally
• Captured govulncheck green run and verbose red demo with temporary vulnerable dependency

Checklist

• Title is a clear sentence (<= 70 chars)
• Commits are signed (git log --show-signature)
• submissions/labN.md updated