fix(G203): treat constant template arguments as safe

[LuisFigueroaG]

G203 already treats hardcoded strings as safe (template.HTML("<b>x</b>") isn't reported), but it decides that by checking for an *ast.BasicLit. A named constant, or a concatenation of constants, is just as hardcoded, yet it gets reported:

const banner = "<b>Scheduled maintenance tonight</b>"

template.HTML(banner)                          // reported
template.HTML("<i>" + greeting + "</i>")       // reported, greeting is a const

The change in rules/templates.go is one line: instead of the *ast.BasicLit check, look at the constant value the type checker records for the argument. Any compile-time constant is treated like a literal. Anything that mixes in a variable, such as "<b>" + name + "</b>", is still reported, and so is a local variable initialized from a literal (as the existing samples expect).

Tests: three new G203 samples. Two are negatives that fail on master (a named constant passed to template.HTML, and constant concatenations passed to template.HTML and template.JS). One is positive: a variable concatenated between literals.

Validation:

• make test (fmt, vet, gosec self-scan, govulncheck, ginkgo): pass
• go test -count=1 ./...: pass
• golangci-lint run (v2.14.0): 0 issues
• built CLI, G203 only, master vs this branch on x/tools, x/net, x/telemetry and google/pprof: same findings (all of them pass non-constant values).

[ccojocar]

Please can you rebase? Thanks

[LuisFigueroaG]

Thanks! Brought the branch up to date with master; tests pass.