chore: fix gosec on non-touched code (#4868)

* fix(ci): only fail lint on issues in changed code

Add only-new-issues: true to golangci-lint action so pre-existing gosec
warnings in untouched files don't fail PR checks. New code is still fully
checked by all rules including G101, G115, G117, G704, and G705.

Author: avallete

.github/workflows/ci.yml

@@ -63,6 +63,7 @@ jobs:
         with:
           args: --timeout 3m --verbose
           version: latest
+          only-new-issues: true
 
   start:
     name: Start