feat: integrate Semgrep for SAST security scanning #392

Description

Integrate Semgrep as a static application security testing (SAST) tool to catch security vulnerabilities, anti-patterns, and dangerous code patterns in the OpenScan codebase.

Part of the Quality Tooling Rollout (#369).

Tasks

• Set up Semgrep in CI via GitHub Actions (official semgrep/semgrep action)
• Add Semgrep-supply-chain for dependency vulnerability scanning
• Configure .semgrep.yml with rulesets relevant to the stack:
  • TypeScript/JavaScript security rules
  • React-specific rules (XSS, dangerous innerHTML, etc.)
  • Ethers.js / wagmi best practices
• Configure PR annotations for findings
• Add Semgrep badge to README

Motivation

Biome handles code style but doesn't cover security patterns. Semgrep catches:

• Hardcoded secrets and API keys
• SQL injection, XSS vectors
• Insecure crypto patterns (relevant for a blockchain explorer)
• Dependency supply-chain risks (via Semgrep Supply Chain)

Notes

• Start with error level only in CI to avoid noise, then expand.
• Consider running on a schedule (nightly) in addition to PR triggers for supply chain checks.