ci: remove semgrep from Python deps

[jd]

This lighten the dependencies chain, making less packages to update and
install.

[Copilot]

Pull Request Overview

This PR removes the semgrep dependency from Python's package dependencies and moves semgrep execution to a separate CI job using a Docker container. This change reduces the Python dependency chain while maintaining semgrep functionality through containerization.

• Removed semgrep from pyproject.toml dependencies
• Updated poe task to use external script instead of direct semgrep command
• Added dedicated semgrep CI job using Docker container
• Updated Mergify configuration to include semgrep check

Reviewed Changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

File	Description
pyproject.toml	Removes semgrep from Python development dependencies
poe.toml	Updates semgrep task to use external tools/semgrep script
.mergify.yml	Adds semgrep check requirement for merge queue
.github/workflows/ci.yaml	Adds dedicated semgrep job using Docker container

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[mergify]

Merge Protections

Your pull request matches the following merge protections and will not be merged until they are valid.

🟢 Changelog requirements

Wonderful, this rule succeeded.

• any of:
  • -title ~= ^feat
  • label = need changelog
  • label = skip changelog

🟢 Enforce conventional commit

Wonderful, this rule succeeded.

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\(.+\))?:

🟢 🔎 Reviews

Wonderful, this rule succeeded.

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0