reliability: treat zero http.Client timeouts as unbounded

[alxxjohn]

Motivation

• Fix a false-negative in the Go reliability check where any http.Client composite literal with a Timeout key was classified as bounded even when the value represented a zero/unbounded duration.

Description

• Change isHTTPClientWithTimeout in internal/codeguard/checks/reliability/reliability_go_helpers.go to verify the Timeout value is not a syntactic zero by calling a new helper isZeroDuration instead of simply checking for the presence of the Timeout key.
• Add the isZeroDuration helper that detects zero durations for common AST patterns including parenthesized/signed zeros, integer literals, time.Duration(0) conversions, and simple binary expressions like 0 * time.Second.
• Add imports for go/token and math/big to support AST token checks and integer parsing.
• Add a regression test TestReliabilityGoFlagsZeroClientTimeout in tests/checks/reliability_test.go that asserts reliability.missing-timeout is reported for Timeout: 0, Timeout: time.Duration(0), and Timeout: 0 * time.Second while preserving existing bounded-timeout behavior.

Testing

• Ran formatting with gofmt -w on the modified files which completed successfully.
• Ran the targeted tests with go test ./tests/checks -run 'TestReliabilityGo(FlagsZeroClientTimeout|DoesNotFlagBoundedHTTPWithContextAndCleanup)$' and the tests passed.
• Ran the full test suite with go test ./... and it completed successfully, confirming the regression test and existing checks pass.

---

Codex Task