* Add semgrep to CI

* Add ignore file

* Flag only new semgrep findings

* Update config.yml
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>