ci: Enable Semgrep and Zizmor scans

[adimoft]

This pull request adds two new GitHub Actions workflows to automate security scanning using Semgrep and Zizmor. These workflows are designed to run on pushes and pull requests to the main branch, improving the project's security posture by integrating automated vulnerability detection into the CI pipeline.

Jira: https://jira.devtools.intel.com/browse/NEXUIE-132281

Security scanning workflows:

• Added .github/workflows/semgrep.yml to run Semgrep scans in a containerized environment, auditing for high-severity issues across the codebase and reporting results in text format.
• Added .github/workflows/zizmor.yml to run Zizmor scans, generate SARIF reports, upload results to GitHub Security, and store artifacts for further review.

Workflow hardening:

• Both workflows use the step-security/harden-runner action to audit egress network activity, enhancing the security of the CI environment. [1] [2]

Compliance and licensing:

• Both workflow files include SPDX copyright and license headers for legal compliance. [1] [2]

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[sudhir-intc]

Need to align this workflow with the guidelines mentioned here: https://wiki.ith.intel.com/pages/releaseview.action?pageId=4314885785#SASTStaticApplicationSecurityTesting-RequiredConfigurationParameters

[adimoft]

This is a public repository, will not have access for calling Intel internal: intel-innersource/frameworks.actions.semgrep-static-code-scan/.github/workflows/semgrep.yml@main