style(ci): keep semgrep config focused