chore(deps): bump golangci-lint to v2.14.0 and fix new findings

Description

Supersedes !4045 (closed). That MR's source branch is in gitlab-renovate-forks/cli, which @duo-developer-gitlab-org can't push to, so this MR includes the golangci-lint bump plus the fixes the lint job needs.

• chore(deps): bump golangci-lint to v2.14.0: the Renovate commit from !4045 (closed), unchanged.
• fix(lint): resolve golangci-lint v2.14.0 findings:
  • modernize stringscut: strings.LastIndex changed to strings.CutLast in cargomatch.go, gemmatch.go, and pypimatch.go.
  • gocritic sprintfQuotedString: "`%s`" changed to %#q in cmd/gen-docs/docs.go and internal/config/confighelp/help.go. The values are command and config key names, so the output is byte-identical (make gen-docs produces no diff).
  • In internal/commands/duo/ask/ask.go I used string concatenation instead of %#q. The colorized command contains ANSI escapes, and %#q would render it as an escaped, double-quoted string.

Related Issues

Related to !4045 (closed)

How has this been tested?

• golangci-lint run (v2.14.0, full repo): 0 issues
• go test for cmd/gen-docs/..., internal/commands/duo/..., internal/dependencyfirewall/..., and internal/config/...: pass
• make gen-docs: no drift

Screenshots (if appropriate):