Dependencies with security issues aren't flagged

The security scan done post-release finds issues (such as CVEs from Go) but we don't seem to have anything that identifies those earlier (even Dependabot should be able to do this, I think).

It would be far better to be aware of these before someone reports them to us, and before we cut a release.

Start by reviewing how the post-release security scan is performed and whether the repository already has dependency automation configured. Determine how Go dependency CVEs can be detected before release, then verify that vulnerabilities are reported before a release is cut.

Written by the indexing model from the issue text.