fix(security): fix gosec suppressions and bump GO_VERSION to 1.25 in security workflow

[valpere]

Summary

• Fix // nosec → // #nosec comment format in pkg/weather/client.go and internal/services/weather_service.go (G704 SSRF false positives on config-driven HTTP calls)
• Add // #nosec G703 to os.Remove(tempFile.Name()) in commands.go (standard temp file cleanup)
• Add // #nosec G101 to test credential in tests/helpers/test_config.go
• Add // #nosec G117 to Password struct fields in internal/config/config.go
• Bump GO_VERSION: 1.24 → '1.25' in security.yml to match go 1.25.0 in go.mod

Root cause

gosec's suppression comment requires a # prefix (// #nosec). Without it (// nosec), the comment is ignored and the issue is still reported. This caused gosec to report 10 issues and exit with code 1, failing the Security Scan workflow.

Test plan

• Security Scan workflow passes on main after merge
• gosec reports Issues: 0, Nosec: 10 locally

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/handlers/commands/commands.go	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!