CI: add gosocialcheck to check whether Go dependencies are already adopted by trusted projects #7406

Description

I propose running gosocialcheck (https://github.com/AkihiroSuda/gosocialcheck) in the CI of docker/cli, moby/moby, etc. so that maintainers can notice untrusted dependency updates.

A "trusted" dependency means:

• go.sum hash appears in CNCF-graduated repositories (cache is updated weekly), or,
• annotated as //gosocialcheck:trusted in go.mod.

An untrusted dependency update doesn't necessarily indicate maliciousness, but it’s worth taking more resources for reviewing.
A trusted one isn't free from potential malware, either, as maintainers of CNCF-graduated repositories may overlook such updates.

Example

gosocialcheck has been already integrated into the CI of Lima, nerdctl, etc.
https://github.com/lima-vm/lima/blob/master/go.mod
https://github.com/containerd/nerdctl/blob/main/go.mod

e.g., When a PR (lima-vm/lima#5583) updates go.sum entries with untrusted hashes, warning annotations are attached to the PR as in the following screenshot: https://github.com/lima-vm/lima/pull/5583/changes

These warning annotations are advisory and do not let the CI job fail.