Closes deferred Phase-9 item 4. Phase 9's rollup added G107 + G704 to
the global gosec.excludes as a stop-gap so the Turnstile siteverify
call wouldn't flag SSRF taint. With Phase 10 introducing webhook
sender that takes user-supplied URLs (validated at the call site via
webhook.validateURL before the request is built), the global excludes
hide the very kind of issue we want flagged anywhere new outbound HTTP
lands.
- gosec.excludes: drop G107 + G704 globally; keep only G104 + G706
(the codebase-wide errcheck/subprocess policies).
- exclusions.rules path-scope G107|G704 to:
* internal/notify/telegram/sender.go (operator-config bot URL)
* internal/notify/webhook/sender.go (user URL with validateURL gate)
* internal/turnstile/verifier.go (operator-config siteverify URL)
- exclusions.rules path-scope G101 to internal/config/config.go where
the env-var-name map (WEBHOOK_HMAC_SECRET, TURNSTILE_SECRET_KEY,
OPERATOR_TOKEN, etc.) trips the hardcoded-credentials regex on
literal env var names — false positives, not actual secrets.
Any new client.Do(req) outside these three packages will surface
G107 at the call site and force the author to add URL validation.
0524d84c89