ci: Enable Semgrep and Zizmor scans

[adimoft]

This pull request adds two new GitHub Actions workflows for automated security scanning. The new workflows integrate Semgrep and Zizmor scans into the CI process, ensuring that code pushed to or pulled against the main branch is checked for security issues. Both workflows include steps for hardening the runner, checking out code, running the scans, and handling scan results.

Jira: https://jira.devtools.intel.com/browse/NEXUIE-132281

Security scanning workflows:

• Semgrep integration

  • Adds .github/workflows/semgrep.yml to perform Semgrep scans on code changes, with results filtered for high severity issues and output in text format. The workflow uses a hardened runner and a containerized Semgrep image for consistent results.

• Zizmor integration

  • Adds .github/workflows/zizmor.yml to run Zizmor scans, outputting results in SARIF format. The workflow uploads scan results to GitHub Security and as an artifact, and uses a hardened runner for improved security.

Security and compliance practices:

• Both workflows include SPDX copyright and license headers for compliance. [1] [2]
• Both workflows use the step-security/harden-runner action to audit and restrict network egress, enhancing CI security. [1] [2]

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.