Fix gosec warnings in all packages

[s3nt3]

gosec is a static analysis tool which can help us automatically identify some basic security issues. We use some rules to scan TiDB (some rules are temporarily disabled and will be selectively enabled in the future), and the warning messages are summarized as follows:

• G101 - CWE 798(8 warnings): hardcoded credentials
• G102 - CWE 200(1 warning): bind to all interfaces
• G107 - CWE 88(1 warning): url provided to HTTP request as taint input
• G109 - CWE 190(1 warning): converting strconv.Atoi result to int32/int16
• G201/G202 - CWE 89(8 warnings): insecure sql query construction using format string/concatenation
• G301/G302 - CWE 276(12 warnings): poor file permissions used when creating a directory/file
• G402 - CWE 295(1 warning): bad TLS connection settings

Fixing these warnings will help improve security, and these fixing tasks are relatively simple, which is suitable for who would like to start contributing to TiDB. The maintainers of related modules and community members are welcome to join in and help resolve these warnings.

Scan using specific rules, for example G101:

$ gosec -include=G101 ./...