refactor: switch to standard Go vendoring for cross-distro packaging

[pcdubs]

Replace go-vendor-tools with standard Go module vendoring to support building on both Fedora and CentOS/RHEL with a single spec file.

Changes:

• Commit vendor/ directory to git (vendored dependency files)
• Include vendor/ directory in Source0 tarball
• Add .gitattributes to exclude vendor/ from GitHub diffs
• Set GO111MODULE=on and GOFLAGS=-mod=vendor for build and test phases
• Remove go-vendor-tools dependency from spec and Packit config
• Add vendor/modules.txt to %license for bundled dependency tracking
• Add testdata files (dc.bin, mfg_key.pem, ov.pem, embed.go) to vendored go-fdo package required by //go:embed directives for build-time compilation

CI workflow updates:

• Exclude vendor/ from codespell spell-check to avoid false positives in third-party dependencies
• Exclude vendor/ from DevSkim security scanner to prevent flagging vendored code issues

This approach follows the standard pattern used by major Go packages in Fedora and matches the vendoring implementation in go-fdo-server.

[mmartinv]

I don't think we need to enable vendoring in this project, it's something related to downstream packaging and should be done by the packaging process.

Am I missing something?

[ben-krieger]

I've been bitten by vendoring in weird ways and seen it break the build.

Sometimes retagging causes hash changes and some of our dependencies do this.

Sometimes you rely on a private repo and you get different hashes if one side didn't have git lfs installed.

The costs don't seem worth it to me. What's the benefit we're hoping for?