extras: run gosec on found roots so as to minimize gosec false positives

[odeke-em]

Requested offline by @ebuchman, it would interesting that for identified state diffed roots and changes, also pass them into gosec which then will run for only those code sections.

[odeke-em]

@elias-orijtech Happy New Year! How are we doing here?