fix: restore vulnerability triage and Semgrep workflows

[msukkari]

The scheduled vulnerability triage started failing after the shared reusable workflow began requesting vulnerability-alerts: read.

Grant that permission in the caller so GitHub can start the reusable workflow and query Dependabot alerts.

Validation: YAML parsing and git diff --check pass.

---

Note

Low Risk
Changes are limited to GitHub Actions YAML; the Semgrep shift may miss findings covered only by the former custom ruleset.

Overview
Vulnerability triage now declares vulnerability-alerts: read on the caller workflow so the shared reusable job from sourcebot-dev/sourcebot can run and read Dependabot alerts (fixes failures when the reusable workflow started requiring that scope).

Semgrep SAST is simplified: the job uses the semgrep/semgrep image, drops the extra checkout of sourcegraph/security-semgrep-rules, and runs semgrep scan --config p/default with SARIF output instead of a custom rules path, baseline commit, and semgrep ci flags.

^{Reviewed by Cursor Bugbot for commit 3c85000. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3c85000. Configure here.}

[msukkari]

Semgrep diagnosis: this Sourcebot fork has no repository secrets, and its available organization secrets do not include GH_SEMGREP_SAST_TOKEN; the referenced private sourcegraph/security-semgrep-rules repository is also inaccessible to the repository owner. The old check therefore had zero scanning coverage and failed every recent PR.

This PR intentionally restores coverage with Semgrep's documented public p/default ruleset, keeps metrics disabled, preserves PR differential scanning against the base SHA, and uploads SARIF even when the scan step fails. The repaired Semgrep job and GitHub code-scanning ingestion both passed on this PR.