ci: Enable Semgrep and Zizmor scans

[adimoft]

This pull request adds two new GitHub Actions workflows to automate security scanning for the repository. The workflows integrate Semgrep and Zizmor scans into the CI/CD pipeline, ensuring that code is checked for security issues on every push and pull request to the main branch.

Jira: https://jira.devtools.intel.com/browse/NEXUIE-132281

Security scanning automation:

• Added .github/workflows/semgrep.yml to run Semgrep scans using a containerized environment, with results focused on high-severity findings. The workflow is triggered on pushes and pull requests to main, and includes runner hardening for improved security.
• Added .github/workflows/zizmor.yml to run Zizmor scans, generate SARIF reports, and upload results to GitHub Security and as build artifacts. This workflow also runs on pushes and pull requests to main, and includes runner hardening and environment setup steps.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.