Investigate running gosec on entire repo

[junshun]

Currently the gosec ignores generatepackagebundle and ecrtokenrefresh. The gosec workload should be updated to handle scanning of all of these folders