Upgrade gosec SAST analyzer to support 1.16

Proposal

Our Category:SAST gosec analyzer does not yet support go 1.16.

In supporting 1.16, we will need to drop our legacy shimming support for projects that do not have go modules enabled, which means go versions before 1.11. Since go supports the last 3 major versions officially, it seems reasonable for us to pin to similar support.

Implementation plan

1. Remove shimming to copy installed modules into gopath
2. Bump go version to 1.16 (relates to #289992 (closed))
3. Bump major version to 3.0.0 to avoid breaking v2 tags for older versions yet to upgrade (relates to #301216 (closed))