Pin go-licenses to v2.0.1 for reproducible builds

[SamMorrowDrums]

Summary

Fixes code scanning alerts #10 and #11 by pinning go-licenses to v2.0.1 for all environments.

Problem

The script/licenses script used @latest for local development while CI was pinned to a specific commit. This triggered two code scanning alerts:

• Alert chore: remove deprecated func #10: bash-go-install-at-latest
• Alert feat: add basic code scanning methods #11: makefile-go-install-at-latest

Both flagged CWE-494: Download of Code Without Integrity Check - using unpinned versions leads to non-deterministic builds.

Solution

• Removed the conditional logic that used @latest for local development
• Pin to v2.0.1 (the current latest release) for all environments
• Simplified the script by removing the CI check for version selection

Before

if [ "$CI" = "true" ]; then
    go install github.com/google/go-licenses@5348b744d0983d85713295ea08a20cca1654a45e # v2.0.1
else
    go install github.com/google/go-licenses@latest
fi

After

go install github.com/google/go-licenses@v2.0.1

Testing

• script/lint passes
• script/test passes

[Copilot]

Pull request overview

This PR addresses security alerts by pinning the go-licenses tool to v2.0.1 for reproducible builds across all environments.

Changes:

• Removed conditional logic that used @latest for local development and a pinned commit for CI
• Pinned go-licenses to v2.0.1 for all environments (CI and local)
• Updated comment to reflect the simplified approach