CI: migrate off the archived semgrep/semgrep-action

[pmatos]

Follow-up from #192. zizmor's archived-uses audit (High confidence) flags semgrep/semgrep-action as coming from an archived repository — it will not receive security updates.

It is currently allow-listed in .github/zizmor.yml (with a rationale comment) so the workflow-lint job stays green. Migrating changes an existing, green scan job, so it was kept separate from the hardening PR.

• Replace semgrep/semgrep-action@v1 with the semgrep CLI (e.g. run semgrep scan --config auto --error via uvx semgrep or the pinned-by-digest semgrep/semgrep container), preserving config: auto and the gating behavior.
• Confirm the scan stays green (no new blocking findings, submodules excluded).
• Remove the archived-uses ignore from .github/zizmor.yml.