Add import of sha1 to gosec whitelist
Add import of sha1 to gosec whitelist

The code checker, gosec, has started flagging the import of crypto/sha1
as potentially weak crypto. It is being used as the hash function for
PBKDF2 when keys are password protected.

In the short term I think removing the warning is fine as it restores
the status quo; need to look further if we really need this code.

Signed-off-by: Justin Cormack <af64ee19f04db9509cb02b0e470e11e5402ef9b3@docker.com>

docker/notary,HuKeping/notary,jfrazelle/notary,HuKeping/notary,jfrazelle/notary,jfrazelle/notary,docker/notary,docker/notary,HuKeping/notary