Remove 47 stale //nolint:gosec directives that are no longer needed after gosec rule changes (nolintlint flagged them as unused). Add //nolint:gosec annotations for 5 new findings: G117 on config struct marshaling (password fields by design), G115 on intentional uint->byte truncation in SCEP OID encoding, and G704 SSRF taint on the user-configured CA HTTP client. Co-authored-by: Claude <noreply@anthropic.com>