Findings from six months of running `govulncheck` in CI