chore: harden repository security automation

[cmilesio]

What

Modernize Wire's security automation and remediate its toolchain dependency advisories.

Compatibility proof

Surface	Change
Minimum Go	Move the module, README, and Linux minimum-version job from Go 1.19 to Go 1.25
Dependency graph	Select golang.org/x/mod 0.40 and x/sys 0.47
Diagnostics	Normalize equivalent compiler wording in tests without changing generated output
Organization-managed CodeQL	Scan all Go source without a duplicate repository workflow
Security evidence	Add fail-closed govulncheck, weekly Dependabot, full-history Gitleaks, and one canonical CycloneDX SBOM
Workflow code	Use immutable action commits and least-privilege permissions

The Go 1.25 increase is required because the patched x/mod 0.40 release requires Go 1.25. The real Go 1.25 suite and vet pass, including custom workspace loading. There is no Wire API, generated-code format, configuration, or persisted-data change.

Why

Wire's compatibility promise is valuable only when the oldest supported compiler runs the real suite. This PR aligns that promise with the first fixed dependency releases and adds reviewable evidence for source, dependencies, secrets, and released source contents.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.