Remove 47 stale //nolint:gosec directives that are no longer needed
after gosec rule changes (nolintlint flagged them as unused). Add
//nolint:gosec annotations for 5 new findings: G117 on config struct
marshaling (password fields by design), G115 on intentional uint->byte
truncation in SCEP OID encoding, and G704 SSRF taint on the
user-configured CA HTTP client.
Co-authored-by: Claude <noreply@anthropic.com>
