ci(govulncheck): bump v1.1.1 -> v1.1.4 to unblock Go 1.25 toolchain

[piotr-roslaniec]

Summary

Follow-up to #18, same root cause.

`govulncheck v1.1.1` transitively imports `golang.org/x/tools@v0.21.1`, whose `internal/tokeninternal/tokeninternal.go:64` contains an array-length trick that evaluates to `-256` on Go 1.25 and fails to compile:

```
invalid array length -delta * delta (constant -256 of type int64)
```

This blocks any dep bump that pushes `go.mod` past `go 1.24.0`. PR #11 (golang.org/x/time v0.15.0) is the immediate trigger — its bump forces `go 1.25.0`. PR #18 already fixed the same issue for `gotestsum` (v1.12.0 → v1.13.0); this is the matching fix for the other `go install`-managed CI tool.

Why v1.1.4 specifically

• v1.1.4: uses `x/tools v0.29.0` (no broken pattern), still requires only `go 1.22.0` minimum. Works on both Go 1.24 (current main) and Go 1.25 (post-chore(deps): bump golang.org/x/time from 0.9.0 to 0.15.0 #11).
• v1.2.0+: requires `go 1.25.0` minimum in its own go.mod, which would prematurely force the toolchain floor on current main. Skipped.

Verification

• `go install golang.org/x/vuln/cmd/govulncheck@v1.1.4` installs cleanly on Go 1.24.
• v1.1.4's go.mod requires only `go 1.22.0`; no toolchain cascade.
• govulncheck is invoked with `continue-on-error: true` in the workflow, so a successful binary install is what matters — no logic change.

Test plan

• CI green on this branch
• After merge: `@dependabot recreate` on chore(deps): bump golang.org/x/time from 0.9.0 to 0.15.0 #11 → expect green