ci(security): add SARIF reporting, gitleaks secret scanning, and Semgrep SAST pipeline (closes #1334)

[guptakumarranjeet150]

Summary

Closes #1334 — Implements a comprehensive automated security scanning pipeline with SARIF reporting, secret leak detection, and static code analysis.

Changes to .github/workflows/security.yml

1. Dependency Vulnerability Scan (existing — cleaned)

• Root-level + frontend + backend npm audit --audit-level=high
• Removed duplicate cargo-audit steps that caused redundant CI runs

2. Rust Cargo Audit with SARIF Upload (upgraded)

• cargo install cargo-audit --version 0.22.0 --locked (pinned, cached)
• Emits cargo-audit.sarif and uploads to GitHub Security tab via github/codeql-action/upload-sarif@v3 with category: cargo-audit

3. Secret Scanning — gitleaks (new)

• gitleaks/gitleaks-action@v2 scans full git history (fetch-depth: 0)
• Docker fallback generates SARIF; uploaded to Security tab with category: gitleaks
• continue-on-error: true so CI does not hard-fail on missing GITLEAKS_LICENSE in forks

4. Semgrep SAST (new)

• Rulesets: p/javascript, p/typescript, p/react, p/nodejs, p/security-audit, p/owasp-top-ten, p/secrets
• SARIF output uploaded to Security tab with category: semgrep-sast

5. CodeQL Multi-Language Analysis (restructured)

• Matrix: javascript, typescript (Rust removed to keep CodeQL DB valid)
• Queries: security-extended,security-and-quality
• Per-language category tag in SARIF upload for clean Security tab grouping

Acceptance Criteria

• Security workflow runs on all PRs and weekly schedule (0 2 * * 0)
• Blocks PRs with known high/critical CVEs (npm audit + cargo audit)
• Generates SARIF reports in GitHub Security tab (cargo-audit, gitleaks, semgrep, codeql)

Closes #1334