feat: add GitHub workflow semgrep rules

[NicholasEllul]

This pull request adds GitHub specific Semgrep rules to the security code scanner. These rules help flag a variety of pitfalls a developer may encounter during development of GitHub workflows

Identical PR to MetaMask/semgrep-action#12

---

Note

Introduces GitHub Actions-focused Semgrep security rules and tests to flag injection and unsafe checkout patterns.

• Adds rules: run-shell-injection, github-script-injection, curl-eval, pull-request-target-code-checkout, workflow-run-target-code-checkout, and checkout-pr-on-issue-comment
• Each rule includes remediation/help text, metadata (CWE/OWASP), and precise patterns for risky run: steps, actions/github-script, curl | eval, and unsafe actions/checkout with pull_request_target, workflow_run, or issue_comment
• Adds corresponding .test.yaml workflows validating rule detections (ruleid) and safe cases (ok)

^{Written by Cursor Bugbot for commit 7a2b47e. This will update automatically on new commits. Configure here.}

[cursor]

Rule missing alternative trigger format patterns

Medium Severity

The workflow-run-target-code-checkout rule only matches the object format for the on: trigger, while the similar pull-request-target-code-checkout and checkout-pr-on-issue-comment rules use pattern-either to match three formats: object format (on: ... workflow_run: ...), list format (on: [..., workflow_run, ...]), and simple format (on: workflow_run). This inconsistency means workflows using list format won't be detected by this rule.