build: use semgrep to prevent using @latest tags for go install steps

Tools should be pinned to a specific dependency when using `make bootstrap`
to Go install the tools we use to build Nomad. Using @latest tags means a
tool and what it produces could change out from under us.

.semgrep/makefile.yml

+rules:
+  # Check use of latest versions in bootstrap tools
+  - id: "go-install-latest-versions"
+    patterns:
+      - pattern-regex: "@latest$"
+    message: "Use specific version tag not latest"
+    languages:
+      - "generic"
+    severity: "WARN"
+    paths:
+      include:
+        - "GNUMakefile"