Adds local semgrep scanning with blocking CI rules. Since this is
local it will run without needing to log in to semgrep and can
therefore run on external branches.