fix gosec issues and add gosec action

[asalzmann]

Summary

• Add gosec to actions, a golang security checker for the cosmos sdk built by informal systems https://github.com/informalsystems/gosec
• Fix a number of issues raised by gosec
• Add a gosec and ci target to the Makefile

gosec fixes

There were two main types of changes raised by gosec

First, ints were being cast unsafely and could overflow. This was fixed by switching to using cast... https://github.com/spf13/cast

Second, non-deterministic map iteration was fixed

In Go, iterating over maps is intentionally non-deterministic as the runtime defines. Unfortunately for us, in the Cosmos-SDK, we encountered an issue with non-deterministic upgrades in Issue cosmos-sdk#10188 PR cosmos-sdk#10189 that resulted from exactly this non-deterministic iteration. To ensure determinism, we only permit an iteration to retrieve the map keys and then those keys can then be sorted, so instead of

for k, v := range m {
    // Do something with key and value.
    _, _ = k, v
}

the requested pattern is

keys := make([]string, 0, len(m))
for k := range m {
    keys = append(keys, k)
}
sort.Strings(keys)

for _, key := range keys {
    // Use the value.
    _ = m[key]
}

go doesn't support generics, so I added a number of files in utils to handle different map types

Test plan

Install gosec locally with go install github.com/securego/gosec/v2/cmd/gosec@latest
Then, make sure gosec action passes: make gosec

[riley-stride]

Looks good and the tests passed for me! Added the gosec install instructions to the PR description and a few comments throughout. Two main Qs:

• should we be using cast in more places than the changes shown in this PR?
• nit: can we condense the utils.go by using interfaces (see the go playground example in my comment)

[riley-stride]

Please check whether we need to sort app.go:849 before merging

[asalzmann]

I don't think we need to sort in app.go:849 because it returns another map (the order of which is non-deterministic anyway)

[riley-stride]

lgtm, discussed in person!