Run semgrep wf

[sarasvoss]

PR Summary

Jira: https://opensesame.atlassian.net/browse/CORE-5315

Description of Changes

• created new reusable action for upserting PR comment
• refactored run semgrep workflow for maintainability
• setup repo to enforce version tags, Changelogs, and Readmes for reusable workflows

Versioning

⚠️ Components in this repo are used by multiple repos and teams. Breaking changes to non-versioned components are high-risk. Always apply correct versioning to versioned components to ensure safe, controlled updates.

Versioned components live under ./github/actions

Does this PR modify a versioned component?

• No — label this PR with version:untracked
• Yes
  • Add a version label: version:<component-name>/X.Y.Z
  • Ensure the component’s CHANGELOG.md includes a ## X.Y.Z entry
  • Use version:untracked only if changes do not alter behavior, inputs, or outputs

If version labels are incorrect or missing, automated version validation will fail and block merge.

Dependencies of PR

N/A

Testing

semgrep workflow runs on PR of this repo so fully tested before merge

[github-actions]

✅ Semgrep Security Scan Passed

🎉 No security issues found!

View run
_{🤖 Powered by Semgrep + reviewdog}

[github-actions]

Tags

The following tags will be created on main after merge

🏷️ actions/upsert-pr-comment/1.0.0
🏷️ workflows/run_semgrep_scan/1.0.0