Pin govulncheck to v1.3.0 to resolve the pull-etcd-govulncheck failure

[ahrtr]

govulncheck's latest version v1.4.0 introduces a regression, which is causing pull-etcd-govulncheck failure. So pin the version to v1.3.0 to resolve this.

See discussion in #21959

The main branch has already been fixed in #21990. We need to backport the PR to stable releases.

Contribution is welcome. thx

[vivekpatani]

/assign for back porting

[kubernetes-prow]

@vivekpatani: GitHub didn't allow me to assign the following users: for, back, porting.

Note that only etcd-io members with read permissions, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

Details

In response to this:

/assign for back porting

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ahrtr]

/assign @vivekpatani

[vivekpatani]

Hey @ahrtr, I did a bit of recon work, the golang/go#80059 panic can't happen on release-3.5 or release-3.6.

it's the scan mode, not the govulncheck version:

• main has a go.work and scans all modules in one process (run_for_all_workspace_modules). That single combined call is what trips the *types.TypeParam panic in x/tools@v0.46.0.

• release-3.5/3.6 have no go.work and scan per module (run_for_modules). Each scan is small and never hits it.

• ran the regressed v1.4.0 on both branches:

branch	govulncheck	govuln pass
release-3.6	v1.4.0	PASS (exit 0)
release-3.5	v1.4.0	PASS (exit 0)

Nothing to backport. Suggest closing as not applicable to stable releases? Thoughts?

[ahrtr]

release-3.7 fails
https://prow.k8s.io/view/gs/kubernetes-ci-logs/logs/post-etcd-govulncheck/2069341985822478336

[vivekpatani]

noted, sorry didn't realize 3.7 branch was separate, will address this, thanks.