ci: add semgrep SAST scanning to CI and pre-commit (#14964)

* ci: add semgrep SAST scanning to CI and pre-commit

Add semgrep static analysis to the security workflow and pre-commit
hooks. Uses `--config auto` for comprehensive coverage across Python,
Dockerfile, and GitHub Actions. The intentional `USER root` in the
Dockerfile (required for bind mount compatibility) is excluded via
`--exclude-rule`.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ci: pin semgrep container image to digest for zizmor

Pin semgrep/semgrep to sha256 digest (v1.151.0) to satisfy
zizmor's unpinned-images audit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ci: add zizmor pre-commit hook for Actions security audit

Matches the existing actionlint pattern — gracefully skips if zizmor
is not installed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.pre-commit-config.yaml

@@ -76,6 +76,18 @@ repos:
         files: 'main\.yml|server\.yml|users\.yml'
         pass_filenames: false
 
+      - id: semgrep
+        name: Semgrep security scan
+        entry: >
+          bash -c '
+          command -v semgrep >/dev/null &&
+          semgrep --config auto
+          --exclude-rule dockerfile.security.last-user-is-root.last-user-is-root
+          --error --quiet --skip-unknown-extensions .
+          || echo "semgrep not installed - skipping"'
+        language: system
+        pass_filenames: false
+
       - id: actionlint
         name: GitHub Actions lint
         entry: bash -c 'command -v actionlint >/dev/null && actionlint .github/workflows/ || echo "actionlint not installed - skipping"'
@@ -83,6 +95,13 @@ repos:
         files: '^\.github/workflows/.*\.yml$'
         pass_filenames: false
 
+      - id: zizmor
+        name: GitHub Actions security audit
+        entry: bash -c 'command -v zizmor >/dev/null && zizmor .github/workflows/ || echo "zizmor not installed - skipping"'
+        language: system
+        files: '^\.github/workflows/.*\.yml$'
+        pass_filenames: false
+
 # Configuration for prek
 
 # Files to exclude globally