pin gosec to 2.20.0 (kserve#3921) (#408)

Signed-off-by: Jin Dong <greenmoon55@users.noreply.github.com>
Co-authored-by: Jin Dong <greenmoon55@users.noreply.github.com>

.github/workflows/scheduled-go-security-scan.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@master
+        uses: securego/gosec@v2.20.0
         with:
           args: '-no-fail -fmt=sarif -out=go-security-scan-results.sarif -exclude-dir=pkg/client -exclude-dir=pkg/clientv1alpha1 ./...'