ci: make security guardian work with merg backs from main (#36304)

### Issue # (if applicable)

Closes #<issue number here>.

### Reason for this change

Fixes security guardian failures like in : 
- https://github.com/aws/aws-cdk/actions/runs/19962933480/job/57247510443
- https://github.com/aws/aws-cdk/actions/runs/19961622290/job/57243193536
- https://github.com/aws/aws-cdk/actions/runs/19961507514/job/57242822537

### Description of changes



### Describe any new or updated permissions being added




### Description of how you validated changes



### Checklist
- [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: kumvprat

tools/@aws-cdk/security-guardian/src/get-changed-files.ts

@@ -7,7 +7,7 @@ export async function detectChangedTemplates(baseSha: string, headSha: string, w
   core.info(`Detecting changed .template.json files from ${baseSha} to ${headSha}`);
 
   let stdout = '';
-  await exec.exec('git', ['diff', '--name-status', `${baseSha}`, `${headSha}`], {
+  await exec.exec('git', ['diff', '--name-status', `${baseSha}..${headSha}`], {
     listeners: {
       stdout: (data: Buffer) => {
         stdout += data.toString();