feat: Add SAST Tools guide for DevSecOps roadmap

[bobbyonmagic]

Partial fix for #750 - adds SAST Tools guide (skill 6 of 24)

Changes

• 5 new guide files covering SonarQube, Semgrep, and CodeQL
• Updated DevSecOps roadmap with link to guide

Guide Contents

1. SAST Fundamentals - How static analysis works, types (pattern matching, data flow, taint tracking), limitations
2. SonarQube - Docker setup, quality gates, CI/CD integration (GitHub Actions, GitLab CI, Jenkins)
3. Semgrep - Custom rules, registry usage, pre-commit hooks, pattern syntax
4. CodeQL - QL language basics, security queries, GitHub Code Scanning integration

Fact-Check Summary

• SonarQube default port 9000 ✅
• Semgrep rule packs (p/security-audit, p/owasp-top-ten) ✅
• CodeQL two-phase approach (database creation → query) ✅
• GitHub Code Scanning free for public repos ✅

All 4470 tests pass.

[cloudflare-workers-and-pages]

Deploying devops-daily with    Cloudflare Pages

Latest commit:	31e3c1b
Status:	✅  Deploy successful!
Preview URL:	https://8bedeb78.devops-daily.pages.dev
Branch Preview URL:	https://issue-750-sast-tools-guide.devops-daily.pages.dev

View logs