chore: sync semgrep.yaml from security-config

Author: security-config-sync[bot]

semgrep.yaml

@@ -21,7 +21,7 @@ rules:
   # SECTION 1: GENERIC SECRETS DETECTION — Applies to all file types
   # ==========================================================================
 
-  - id: generic-hardcoded-secret
+  - id: generic-hardcoded-secret  # pragma: allowlist secret
     languages: [generic]
     severity: ERROR
     message: |
@@ -77,7 +77,7 @@ rules:
       cwe: "CWE-798"
       category: "security"
 
-  - id: generic-aws-secret-access-key
+  - id: generic-aws-secret-access-key  # pragma: allowlist secret
     languages: [generic]
     severity: ERROR
     message: |
@@ -361,7 +361,7 @@ rules:
       category: "security"
       note: "Not necessarily dangerous, but aggregated roles can accumulate unexpected permissions if selectors are too broad"
 
-  - id: k8s-rbac-secrets-cluster-access
+  - id: k8s-rbac-secrets-cluster-access  # pragma: allowlist secret
     languages: [yaml]
     severity: WARNING
     message: |
@@ -498,7 +498,7 @@ rules:
       cwe: "CWE-653"
       category: "security"
 
-  - id: k8s-secret-in-configmap
+  - id: k8s-secret-in-configmap  # pragma: allowlist secret
     languages: [yaml]
     severity: ERROR
     message: |
@@ -541,7 +541,7 @@ rules:
       cwe: "CWE-522"
       category: "security"
 
-  - id: yaml-hardcoded-secret
+  - id: yaml-hardcoded-secret  # pragma: allowlist secret
     languages: [yaml]
     severity: WARNING
     message: |
@@ -744,10 +744,10 @@ rules:
   # SECTION 4: GITHUB ACTIONS SECURITY — Workflow files
   # ==========================================================================
 
-  - id: github-actions-hardcoded-secret
+  - id: github-actions-hardcoded-secret  # pragma: allowlist secret
     languages: [yaml]
     severity: ERROR
-    message: |
+    message: |  # pragma: allowlist secret
       Hardcoded secret in GitHub Actions workflow.
 
       Security Risk: Secrets in workflows are visible in git history and to all collaborators.
@@ -1814,7 +1814,7 @@ rules:
     metadata:
       category: "security"
 
-  - id: dockerfile-secret-in-env
+  - id: dockerfile-secret-in-env  # pragma: allowlist secret
     languages: [dockerfile]
     severity: ERROR
     message: |