Re-add download module source code to gosec-sast job

The gosec-sast job started failing around 7 months ago during the before_script section when the make command was being run.

The job was fixed by removing the before_script section but that only does a shallow dependency scan. We should add this back in to make sure a deep dependency scan is done.

We could consider using pre-compilation to avoid using a before_script

The following discussion from !128 (merged) should be addressed: