fix: suppress gosec G115/G118 false positive warnings

- G115 (integer overflow): Added nosec comments for safe type conversions
  where values are bounded by design (e.g., rng.Intn(255) returns 0-254)
- G118 (context.Background): Added nosec for intentional async goroutines
  that use WithTimeout for bounded execution after request completes

Note: G101 (hardcoded credentials) warnings are low-confidence false
positives - OAuth fields use getEnv() to read from environment.

internal/service/webhook.go

@@ -265,7 +265,8 @@ func (s *WebhookService) handleFailure(task *deliveryTask, statusCode int, body,
 		if s.config.RetryBackoff == "fixed" {
 			backoff = 2 * time.Second
 		} else {
-			backoff = time.Duration(1<<uint(task.attempt)) * time.Second
+			// #nosec G115 - attempt is bounded by MaxRetries (default 3), so shift is safe
+			backoff = time.Duration(1<<uint(task.attempt)) * time.Second // #nosec G115
 		}
 		time.AfterFunc(backoff, func() {
 			task.attempt++