fix(ci): triage semgrep findings, make the gate blocking (WP-30 #6)

Local semgrep run found 25 findings (not the WP's remembered 27 — already-stale
by the time this ran): dependabot cooldown, npm min-release-age, every GitHub
Action pinned to a full commit SHA (dependabot's existing github-actions
ecosystem entry keeps these current), and 2 detect-non-literal-regexp findings
in e2e/create-ssp.mjs suppressed as false positives (non-attacker-controlled
input: a test's own captured version number, a local generator's CLI arg).
`semgrep scan` now runs with `--error`, a real blocking gate instead of
report-only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

e2e/brief-v2.spec.ts

@@ -92,7 +92,12 @@ test('drafter composes → approver sends; admin republishes appearance', async
   // --- Restore: put the org template's appearance back the way this test found it ---
   await page.goto('/brief/huisstijl?role=admin');
   await page
-    .locator('.history-row', { hasText: new RegExp(`Versie ${beforeVersion} ·`) })
+    .locator('.history-row', {
+      // beforeVersion is a number this test itself captured earlier, never external/attacker input
+      // (detect-non-literal-regexp false positive — the reported check_id doesn't match what
+      // `nosemgrep` compares against for this rule, confirmed by trial; bare form suppresses it).
+      hasText: new RegExp(`Versie ${beforeVersion} ·`), // nosemgrep
+    })
     .getByRole('button', { name: 'Terugzetten in concept' })
     .click();
   await expect(orgNameInput).not.toHaveValue(unique);