feat: add rule to catch npx usage in JS/TS/YAML

[NicholasEllul]

This pull request expands on the existing rules that flags the usage of npx in shell / package.json such that we identify npx usage in a wider range of contexts.

---

Note

Adds security-focused detection for unsafe npx usage across code and CI.

• New rules: packages/semgrep-action/rules/src/generic/npx-usage/npx-usage-js.yml (JS/TS) uses a string regex to flag any occurrence of npx ; packages/semgrep-action/rules/src/generic/npx-usage/npx-usage-yml.yml (YAML) matches run: $CMD where shell command starts with npx ...
• Rule messages and help text explain supply chain risk and recommend installing dependencies and invoking via package manager
• Tests added under packages/semgrep-action/rules/test/generic/npx-usage/ covering positive cases (e.g., npx jest, scoped packages, flags, chaining) and negative cases (e.g., yarn, npm run, yarn dlx)

^{Written by Cursor Bugbot for commit b1c6c5e. This will update automatically on new commits. Configure here.}