Fix: resolve gosec G304 lint failure in Terraform module cache check (#7190)

Wrap the cache remote marker read in filepath.Clean, the same pattern
other os.ReadFile call sites in this repo use to satisfy gosec. The
path is built from filepath.Join and a constant suffix, with the module
name validated beforehand, so behavior is unchanged.

The finding surfaced on master after the GHSA-fmgp-q6jx-gg3x merge
because the advisory workflow did not run the full lint job.

Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>

pkg/controller/utils/capability.go

@@ -268,7 +268,7 @@ func cacheMatchesRemote(cachePath, remoteURL string) bool {
 	if err != nil || len(entities) == 0 {
 		return false
 	}
-	recorded, err := os.ReadFile(cachePath + cacheRemoteMarkerSuffix)
+	recorded, err := os.ReadFile(filepath.Clean(cachePath + cacheRemoteMarkerSuffix))
 	if err != nil {
 		return false
 	}