ci(snyk): tag CLI scans with public repo URL so they use the open-source quota

Snyk CLI scans without --remote-repo-url can't read GitHub visibility and
default to counting against the private test quota, even for public repos.
Pass the repo URL so these scans land in the unlimited open-source buckets.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: bennyjo

.github/workflows/snyk-security.yml

@@ -35,11 +35,11 @@ jobs:
         uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
 
       - name: Snyk Code test
-        run: snyk code test --sarif > snyk-code.sarif
+        run: snyk code test --remote-repo-url=https://github.com/${{ github.repository }} --sarif > snyk-code.sarif
         continue-on-error: true
 
       - name: Snyk Open Source monitor
-        run: snyk monitor --file=requirements.txt --package-manager=pip --skip-unresolved
+        run: snyk monitor --file=requirements.txt --package-manager=pip --skip-unresolved --remote-repo-url=https://github.com/${{ github.repository }}
 
       - name: Upload result to GitHub Code Scanning
         uses: github/codeql-action/upload-sarif@v3