fix: address code quality and security issues from PR review

[Copilot]

Addresses 18 unresolved review comments on PR #136 covering thread safety, output handling, AWS spec compliance, and example security.

Core Code Fixes

Thread safety: Added sync.RWMutex to VDB client token cache with double-checked locking pattern. Token refresh buffer increased to 3 minutes.

AWS SigV4 compliance: Canonical request now includes query string component per AWS spec:

canonicalRequest := fmt.Sprintf("%s\n%s\n%s\n%s\n%s\n%s",
    req.Method,
    path,
    canonicalQueryString,  // Was missing
    canonicalHeaders,
    signedHeaders,
    payloadHash,
)

Output separation: Informational messages now write to stderr when --output json is used, keeping stdout clean for piping.

Variable scoping: Moved vdbLimit and vdbOffset from global to per-command locals to prevent flag interference between commands.

Error handling: Fixed ignored json.Unmarshal error in CVE data parsing. Extracted pagination logic into buildPaginationQuery() helper.

Example & Documentation Security

Secrets handling: Troubleshooting now checks credential existence without printing values. Config example uses REPLACE_WITH_YOUR_SECRET_KEY placeholder instead of zeros.

CI/CD hardening:

• Added SHA-256 checksum verification for binary downloads
• Fixed command substitution error handling (if ! cmd=$(...) pattern)
• Added error handling after jq parsing
• Fixed GitHub Actions conditionals from numeric to string comparison (!= '0' instead of > 0)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.