fix(ci): pin govulncheck-action to the v1.1.0 release (#32304)

golang/govulncheck-action published v1.1.0 on 2026-07-10, tagging the
master commit (032d455) the govulncheck step was already pinned to.
Update the pin comment to # pin@v1.1.0 so it matches the repo's
pin@<tag> convention and Dependabot can track the action by semver
again.

The pinned SHA is unchanged; v1.1.0 points to that commit, so CI
behavior is identical and only the trailing comment changes.

Closes: #32301

Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

.github/workflows/govulncheck.yml

@@ -30,6 +30,6 @@ jobs:
           go-version: '${{ env.GOLANG_VERSION }}'
           check-latest: true
       - name: govulncheck
-        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # pin@032d455 (from main 2026-07-06)
+        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # pin@v1.1.0
         with:
           go-package: ./...