The GitHub action provide the arguments as a single string to the docker container, so we need to expand them in order for gosec to properly interpret them. Signed-off-by: Cosmin Cojocar <cosmin.cojocar@gmx.ch>