ci: fix the security scan, which has failed on every push

Two unrelated causes, plus one that hid the others.

govulncheck: setup-go used go-version-file, so it installed exactly what
each go.mod pins -- `go 1.25.0` -- and then reported 28 CVEs in that
release's standard library (crypto/x509 quadratic name-constraint
parsing, GO-2025-4007, and friends), all fixed in 1.25.3. None of it
described anything we ship: every Dockerfile builds FROM
golang:1.25-alpine, a floating tag that resolves to the newest 1.25.x,
so the binaries already had the fixes. The go directive is a minimum
language version, not a statement about which toolchain to audit with.
Track the floating 1.25 line instead, and the scan matches production.
Confirmed by running govulncheck against a patched toolchain locally:
deploy/operator reports 0 vulnerabilities and exits 0.

cargo-deny: RUSTSEC-2024-0384, `instant` is unmaintained. A maintenance
advisory rather than a vulnerability -- no CVE, nothing to patch -- and
it arrives transitively via tantivy 0.22.1 -> measure_time 0.8.3, so it
cannot be dropped without moving off the pinned Tantivy. The advisory's
substance does not apply here anyway: instant papers over
std::time::Instant being missing on wasm, and search builds native musl.
Ignored in search/deny.toml with that reasoning recorded and a note to
delete the entry at the next Tantivy upgrade rather than let it ossify.

Both matrices now set fail-fast: false. Only two of the twelve jobs
actually failed; the other nine were cancelled, which made a two-cause
failure look like a total collapse and hid every finding but the first.

search/deny.toml

@@ -70,6 +70,23 @@ feature-depth = 1
 # A list of advisory IDs to ignore. Note that ignored advisories will still
 # output a note when they are encountered.
 ignore = [
+    { id = "RUSTSEC-2024-0384", reason = """
+`instant` is unmaintained -- a maintenance advisory, not a vulnerability:
+no CVE, no known exploit, nothing to patch.
+
+It reaches us only transitively (tantivy 0.22.1 -> measure_time 0.8.3 ->
+instant 0.1.13), so it cannot be dropped without moving off the pinned
+Tantivy version, and CLAUDE.md pins the stack deliberately.
+
+The advisory's substance does not apply to this build either: `instant`
+exists to paper over std::time::Instant being unavailable on wasm, and
+the recommended replacement (web-time) addresses that same wasm gap.
+search builds for native musl, where instant is a thin pass-through to
+std.
+
+Revisit when Tantivy is next upgraded -- check whether measure_time has
+dropped the dependency, and delete this entry if so rather than letting
+it become permanent.""" },
     #"RUSTSEC-0000-0000",
     #{ id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
     #"[email protected]", # you can also ignore yanked crate versions if you wish