lint: enable govet (all) and a set of correctness linters (#420)

* web: avoid aliasing cert.DNSNames when building the SAN list

gocritic's appendAssign check flags append(cert.DNSNames, cert.EmailAddresses...):
appending to cert.DNSNames mutates its backing array when it has spare
capacity, which could surprise a caller still holding the certificate.
slices.Concat always allocates a fresh slice, which is the intent here.
No functional change; slices is already imported.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: randomizedcoder dave.seddon.ca@gmail.com <dave.seddon.ca@gmail.com>

* lint: enable govet (all) and a set of correctness linters

Mirrors prometheus/blackbox_exporter#1631. Enables copyloopvar,
durationcheck, gocritic, makezero, unconvert, and wastedassign, plus
govet enable-all (minus fieldalignment and shadow, which are noisy /
idiomatic in this codebase). These are low-noise correctness checks;
after the preceding appendAssign fix there are no findings on the tree.

golangci-lint run ./... is clean, and go build / go test ./... pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: randomizedcoder dave.seddon.ca@gmail.com <dave.seddon.ca@gmail.com>

---------

Signed-off-by: randomizedcoder dave.seddon.ca@gmail.com <dave.seddon.ca@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>