feat(ci): pin Semgrep + rule packs (semgrep = "latest" + --config auto lets registry changes break CI)

## Problem

`mise.toml` pins `semgrep = "latest"` (line 27) and `security:sast` uses `--config auto` (line 140), which fetches rules **live from the semgrep registry** at scan time. This means CI's SAST behavior can change with no code change on our side — a newly published or modified rule can turn `main` red unexpectedly.

This is not hypothetical: it is the **root cause of #532** — the `uv-missing-dependency-cooldown` rule (added in semgrep 0.9.17) was picked up automatically and failed the suite, with no change to our code.

## Proposed

- Pin the semgrep engine to an exact version (not `latest`) in `mise.toml`.
- Pin / vendor the rule packs (or at least the `--config` sources) so rule changes are adopted deliberately, not silently.
- Consider a periodic bump (like `upgrade-main.yml`) so updates are reviewed in a PR rather than surprising a scheduled run.

## Acceptance criteria

- SAST rule set is version-controlled / pinned; a registry-side rule change cannot change CI outcome without a PR.

## Context

Maintainer-requested follow-up from #532. See also related CI-hardening issues #329, #328.

Inizia dalle righe 27 e 140 di mise.toml, quindi esamina il workflow CI e upgrade-main.yml citati nell’issue. Esamina #532 e le issue correlate al CI-hardening per comprendere il problema e i pattern di aggiornamento esistenti. Il lavoro è completato quando le modifiche alle regole Semgrep lato registry non possono alterare i risultati SAST senza una PR sottoposta a revisione.

Scritto dal modello di indicizzazione a partire dal testo della issue.