ci: add retry logic for Go module operations (#21609)

## Description

Add exponential backoff retries to all `go install` and `go mod
download` commands across CI workflows and actions.

## Why

Fixes
[coder/internal#1276](https://github.com/coder/internal/issues/1276) -
CI fails when `sum.golang.org` returns 500 errors during Go module
verification. This is an infrastructure-level flake that can't be
controlled.

## Changes

- Created `.github/scripts/retry.sh` - reusable retry helper with
exponential backoff (2s, 4s, 8s delays, max 3 attempts), using
`scripts/lib.sh` helpers
- Wrapped all `go install` and `go mod download` commands with retry in:
  - `.github/actions/setup-go/action.yaml`
  - `.github/actions/setup-sqlc/action.yaml`
  - `.github/actions/setup-go-tools/action.yaml`
  - `.github/workflows/ci.yaml`
  - `.github/workflows/release.yaml`
  - `.github/workflows/security.yaml`
- Added GNU tools setup (bash 4+, GNU getopt, make 4+) for macOS in
`test-go-pg` job, since `retry.sh` uses `lib.sh` which requires these
tools

.github/scripts/retry.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Retry a command with exponential backoff.
+#
+# Usage: retry.sh [--max-attempts N] -- <command...>
+#
+# Example:
+#   retry.sh --max-attempts 3 -- go install gotest.tools/gotestsum@latest
+#
+# This will retry the command up to 3 times with exponential backoff
+# (2s, 4s, 8s delays between attempts).
+
+set -euo pipefail
+
+# shellcheck source=scripts/lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/../../scripts/lib.sh"
+
+max_attempts=3
+
+args="$(getopt -o "" -l max-attempts: -- "$@")"
+eval set -- "$args"
+while true; do
+	case "$1" in
+	--max-attempts)
+		max_attempts="$2"
+		shift 2
+		;;
+	--)
+		shift
+		break
+		;;
+	*)
+		error "Unrecognized option: $1"
+		;;
+	esac
+done
+
+if [[ $# -lt 1 ]]; then
+	error "Usage: retry.sh [--max-attempts N] -- <command...>"
+fi
+
+attempt=1
+until "$@"; do
+	if ((attempt >= max_attempts)); then
+		error "Command failed after $max_attempts attempts: $*"
+	fi
+	delay=$((2 ** attempt))
+	log "Attempt $attempt/$max_attempts failed, retrying in ${delay}s..."
+	sleep "$delay"
+	((attempt++))
+done