fix(ci): correct the govulncheck-action pin comment

The govulncheck step pins golang/govulncheck-action to an untagged
master commit (032d455) because no release since v1.0.4 (Oct 2024)
carries the Node 24 fix. The pin comment named the wrong upstream
branch -- the action's default branch is "master", not "main" -- and
used a "pin@<sha>" form that mimics the repo's "pin@<tag>" convention
for an entry that has no tag.

Name the correct branch and mark the line as manually maintained
until upstream tags a release. Re-pin to the tag once one exists.

Refs: #32301, golang/go#78345
Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>

.github/workflows/govulncheck.yml

@@ -30,6 +30,6 @@ jobs:
           go-version: '${{ env.GOLANG_VERSION }}'
           check-latest: true
       - name: govulncheck
-        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # pin@032d455 (from main 2026-07-06)
+        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # master 032d455 (2026-07-06); no tagged release yet, manually maintained - see #32301
         with:
           go-package: ./...