ci(security): install semgrep via apt+pipx on the runner image

The semgrep job-container approach fails because actions/checkout needs node
inside the container. Install pipx via apt on the standard image instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/security.yml

@@ -58,9 +58,15 @@ jobs:
   # don't look for. Advisory at first (not a required check); promote once tuned.
   sast:
     runs-on: ubuntu-latest
-    container: semgrep/semgrep   # official image — the runner's base image lacks pip
     steps:
       - uses: actions/checkout@v4
+      # The runner image lacks pip, and a semgrep job-container lacks the node that
+      # actions/checkout needs — so install pip via apt on the standard image.
+      - name: Install semgrep
+        run: |
+          sudo apt-get update -qq && sudo apt-get install -y -qq python3-pip pipx
+          pipx install semgrep
       - name: Semgrep scan
         run: |
+          export PATH="$HOME/.local/bin:$PATH"
           semgrep scan --config p/csharp --config p/javascript --config p/security-audit             --exclude 'frontend/dist' --exclude '**/bin' --exclude '**/obj'             --error --quiet