Use latest Go 1.23 patch in CI and run tests even if govulncheck fails.

setup-go was installing go.mod's 1.23.0 exactly, so govulncheck reported stdlib x509 findings and skipped tests. check-latest gets the patched 1.23, and vulncheck is its own job.

.gitea/workflows/test-pr.yaml

@@ -13,6 +13,7 @@ jobs:
       - uses: actions/setup-go@main
         with:
           go-version-file: 'go.mod'
+          check-latest: true
       - run: go mod tidy
       - run: go build ./...
       - run: go vet ./...
@@ -21,7 +22,16 @@ jobs:
         with:
           version: latest
           args: --timeout=5m
-      - run: GOTOOLCHAIN=auto go install golang.org/x/vuln/cmd/govulncheck@latest
-      - run: govulncheck ./...
       - run: go test -race -v -shuffle=on -coverprofile=coverage.out -timeout=5m ./...
       - run: go tool cover -func=coverage.out | tail -10  # basic coverage report
+
+  vulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@main
+      - uses: actions/setup-go@main
+        with:
+          go-version-file: 'go.mod'
+          check-latest: true
+      - run: GOTOOLCHAIN=auto go install golang.org/x/vuln/cmd/govulncheck@latest
+      - run: govulncheck ./...