Build the binary without cgo (closes #545)

make build now builds with CGO_ENABLED=0, and the image builds through
it. The binary's only cgo code was mattn/go-sqlite3, which
gorm.io/driver/sqlite imports and webhooker never opens: every SQLite
file is opened with modernc.org/sqlite and the connection handed to
gorm. Without cgo, mattn's package compiles to a stub nothing calls.

The Dockerfile builds the binary once. The static relink and its
netgo, osusergo and sqlite_omit_load_extension tags are gone, and with
them the Makefile's GO_LDFLAGS and GO_TAGS, which only the relink used.
The test phase keeps cgo for -race. No README or Dockerfile sentence
says the binary needs cgo any more.

Model: opus-5-5

Makefile

@@ -44,9 +44,8 @@ check:
 	@script/check
 
 # Built with cgo off, -trimpath and -s -w, as the Go Dockerfile in
-# REPO_POLICIES.md does: the binary carries no build paths, symbol table or
+# REPO_POLICIES.md does: the binary is statically linked and carries no
-# debug information, and on Linux, the image's included, it is statically
+# build paths, symbol table or debug information.
-# linked.
 build: assets
 	CGO_ENABLED=0 go build -trimpath -ldflags '-s -w -X main.version=$(VERSION)' -o bin/webhooker ./cmd/webhooker