fix: suppress gosec false positives (G101 dev DSN, G704 config-only URL)

G101 flags the default DSN which is a dev placeholder overridden by env
vars in production. G704 flags SSRF on a Vouch client that only calls
URLs from validated config, not user input.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: haasonsaas

pkg/vouch/client.go

@@ -215,7 +215,7 @@ func (c *Client) buildRequest(ctx context.Context, deviceID string) (*http.Reque
 func (c *Client) executeWithRetry(ctx context.Context, req *http.Request) (*http.Response, error) {
 	var resp *http.Response
 	retryErr := retry.Do(ctx, c.config.RetryConfig, func() error {
-		r, err := c.httpClient.Do(req)
+		r, err := c.httpClient.Do(req) // #nosec G704 -- URL is from validated config, not user input
 		if err != nil {
 			return err
 		}

services/inventory/main.go

@@ -11,7 +11,7 @@ import (
 
 const (
 	defaultBindAddr    = ":8080"
-	defaultDSN         = "postgres://postgres:postgres@postgres:5432/keep?sslmode=disable"
+	defaultDSN         = "postgres://postgres:postgres@postgres:5432/keep?sslmode=disable" // #nosec G101 -- dev-only default, overridden by env var in production
 	defaultTLSCert     = ""
 	defaultTLSKey      = ""
 	defaultAuthzJWKS   = ""