add Semgrep CE to public and private code-security-analysis workflows

[ashmoz]

Adds a semgrep job to both reusable workflows

1. Public repo: p/owasp-top-ten + p/secrets + p/security-audit → SARIF → GHAS code scanning (category 'semgrep'). Does not fail on findings.
2. Private repo: same rulesets, --error so the job fails on ERROR-severity findings (surfaced as workflow annotations on the diff).