feat: add semgrep security issues scanning

[cohow]

Resolves #949

QA: cohow#1
semgrep run: https://github.com/cohow/ubiquity-dollar/actions/runs/10865401897/job/30151817077?pr=1

[rndquu]

In the provided QA run the Run semgrep ci --sarif --output=semgrep.sarif || true step has this output:

Scanning 1 file tracked by git with 54 Code rules:
Nothing to scan.
Current version has 0 findings.

It seems there's smth wrong with the workflow setup because nothing was scanned. Pls refactor accordingly and make sure semgrep is run against https://github.com/ubiquity/ubiquity-dollar/tree/development/packages/contracts/src/dollar.

[cohow]

In the provided QA run the Run semgrep ci --sarif --output=semgrep.sarif || true step has this output:

Scanning 1 file tracked by git with 54 Code rules:
Nothing to scan.
Current version has 0 findings.

It seems there's smth wrong with the workflow setup because nothing was scanned. Pls refactor accordingly and make sure semgrep is run against https://github.com/ubiquity/ubiquity-dollar/tree/development/packages/contracts/src/dollar.

I've pushed a fix that should fix that and scan only files in the packages/contracts/src/dollar directory

QA Run: https://github.com/cohow/ubiquity-dollar/actions/runs/10903661456/job/30259764076#step:5:18

side note: i could not get semgrep ci to correctly run and scan all the files in the directory as it seems to only scan files that have changed since baseline commit so I've used semgrep scan instead for scanning and specifying directory. I believe the results are the same but let me know if there's any difference.

[cohow]

Ok i'm not sure how I missed that but I managed to make it run with semgrep ci which works better, it's currently running on push and pull request I believe

push QA: https://github.com/cohow/ubiquity-dollar/actions/runs/10904764860/job/30261986841#step:5:19
pull QA: https://github.com/cohow/ubiquity-dollar/actions/runs/10904765962/job/30261990853#step:5:22

PR scan uses diff-aware scanning to limit the scan to files changed since baseline commit.