ci(semgrep): add scan workflow

[Boshen]

Summary

• add Semgrep CE scans for pull requests and pushes to main
• pin Semgrep to v1.170.0
• use the repository's pinned taiki-e/checkout-action and concurrency convention

Testing

• use the workflow already validated in oxc-project/oxc
• verify the pull request with GitHub Actions before merging

AI usage

This change was implemented with assistance from OpenAI OpenCode. The contributor remains responsible for reviewing and understanding the change.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6a7d502b68

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Fail the Semgrep check on findings

When this workflow is used as a PR/status check, semgrep scan exits successfully even when it reports matches; Semgrep's CLI docs state exit code 0 is used when findings exist unless the --error flag is enabled. Because this workflow also does not upload SARIF or otherwise publish results, security findings are only hidden in logs while the check stays green, so add --error here if the scan is meant to protect PRs and main pushes.

Useful? React with 👍 / 👎.