ci: enable language vulnerability scanning on container_scanning

This turns on language-specific findings in the container_scanning job. The upstream Container-Scanning template's CS_DISABLE_LANGUAGE_VULNERABILITY_SCAN defaults to "true", so the report has only ever covered OS packages and never looked at the Go modules built into the executor binary, the binary this project's FIPS claim rests on.

On this MR's own pipeline, the container_scanning job's report gains the Go findings it did not show before: with the x/crypto override already on main, expect the go-archive High (CVE-2026-17106) and the docker/docker, buildkit and grpc findings, none of which has a fix from us yet.

Nothing in the images changes. This is a reporting change only; deciding how to fix the Go dependency tree is separate work.