Remove 47 stale //nolint:gosec directives that are no longer needed
after gosec rule changes (nolintlint flagged them as unused). Add
//nolint:gosec annotations for 5 new findings: G117 on config struct
marshaling (password fields by design), G115 on intentional uint->byte
truncation in SCEP OID encoding, and G704 SSRF taint on the
user-configured CA HTTP client.
Co-authored-by: Claude <noreply@anthropic.com>
Since Go 1.13 a net.Listen keep-alive is enabled by default if
the protocol and OS supports it. The new one is 15s to match
the net.Dial default one. Previously http.Server ListenAndServe
and ListenAndServeTLS used to add a wrapper with 3m that we
replicated.
See https://github.com/golang/go/issues/31510
