GitRacks security actions

A reusable workflow that runs Trivy, Gitleaks and Semgrep and uploads their SARIF reports to GitRacks:

jobs:
  security:
    uses: gitracks/security-actions/.gitea/workflows/security.yml@v1
    with:
      fail-on: high

The NixOS module publishes this directory as the public repository gitracks/security-actions and moves its v1 tag on upgrades (services.gitracks.security.enable). Elsewhere, push this directory to a public repository on your instance and tag it v1. Inputs and the severity gate are described in the GitRacks docs (docs/fork/security.md).

The bundled Semgrep rules are GitRacks' own (MIT).