Corpus: add a Go SSRF detection test case

[bkd-dotcom]

Add a corpus case exercising SSRF detection in Go.

Where: signetry_eval/detection/corpus/ — add a case with a cited provenance (link/CWE), plus a SAFE decoy that must stay 0 false positives.

Acceptance criteria:

• One vulnerable Go snippet (http.Get(r.URL.Query().Get("u"))-style) that the engine flags as ssrf / CWE-918.
• One safe Go snippet (constant URL) that is NOT flagged.
• Corpus-integrity test passes: uv run pytest -q.

See existing cases in the corpus for the exact format. Depends on signetry-core@v0.6.0 (installed automatically).

[bkd-dotcom]

Done in #31 (merged).

LANG-59-go-ssrf (CWE-918), giving SSRF a second language alongside Python, plus a LANG-60-SAFE-go-constant-url decoy.

Needed go.taint.ssrf in core first (Signetry/core#95) — Go SSRF was undetected.

The decoy is the interesting part: it immediately caught a false positive in that brand-new rule — a constant host with a user-supplied query string was reported as SSRF, when the destination is compiled in and only the query varies. Same FP class the Python rule is held to, so fixed in Signetry/core#97 before the corpus landed.

Corpus is now 60 cases at recall 1.0 with 0 false positives, verified against the published core v0.7.0 tag in a clean environment.