feat(ci): SAST depth and supply-chain scorecard — Semgrep next to CodeQL, OpenSSF Scorecard as a ratchet

[FelixTJDietrich]

Extracted from the post-closure extension of #1592 — that issue is closed (merge queue, zizmor, reliability all shipped via #1623), and scope written into a closed issue is untracked. This issue is the open home for the remaining scanning depth:

• Semgrep (or an equivalent rule-pack SAST) as a CI leg complementing CodeQL — CodeQL covers Java/JS deep dataflow; Semgrep adds fast, rule-authorable checks (incl. the repo's own policy patterns, which today live as bespoke grep gates in ci-security-scan.yml — migrate what fits, keep what doesn't). SARIF → code scanning, SHA-pinned, required only after a green launch (same protocol as zizmor).
• OpenSSF Scorecard via the official action, published to code scanning, with the score treated as a ratchet (record the baseline, fail on regression, improve deliberately — pinned-dependencies, token-permissions, and branch-protection checks should already score well after fix(ci): repair broken gates and add a self-verifying CI contract #1588–chore(ci): harden the build and release supply chain #1631).

Done when both scanners run on main and PRs, launch green, their alerts feed code scanning, and the Scorecard baseline + ratchet policy is recorded in this issue. Sequencing: workflows lane — after #1646 and the #1590 chain fix land (same hot-file lane).