ci: add Semgrep OSS scanning workflow

[hrushikeshdeshpande]

Summary

Adds Semgrep Community Edition (OSS) scanning to this repository as part of the App&ProdSec team's migration from Semgrep Pro to Semgrep CE.

What it does

• Runs on every PR, on push to the main/master branch, and monthly on a staggered schedule.
• Uses actions/cache@v5 so pip install semgrep only runs on cold cache (first run, version bump, or 7-day idle).
• Pinned to semgrep==1.160.0 with --config=auto (default OSS ruleset).
• Runs on ubuntu-slim with contents: read token scope.

For reviewers

• Findings are informational; the job does not block on findings.
• First PR after merge installs Semgrep; subsequent PRs skip that step.

See the internal App&ProdSec email for migration context, or ping us internally.

[cloudflare-workers-and-pages]

Deploying airtable-form-example with    Cloudflare Pages

Latest commit:	9395b24
Status:	✅  Deploy successful!
Preview URL:	https://1485116a.airtable-form-example.pages.dev
Branch Preview URL:	https://hrushikesh-add-semgrep-oss-w.airtable-form-example.pages.dev

View logs