ci(security): add initial SAST workflows and plan

[grove]

Summary

• add a first-pass SAST stack for the PostgreSQL extension
• add GitHub Actions workflows for CodeQL, cargo-deny, and Semgrep
• add a detailed rollout plan in plans/testing/PLAN_SAST.md

What Changed

• add Rust CodeQL analysis using the repo's existing pgrx setup
• add cargo-deny checks backed by deny.toml
• add an advisory Semgrep scan with SARIF upload
• add initial extension-specific Semgrep rules for dynamic SPI SQL and SECURITY DEFINER review
• document the threat model, phased rollout, rule roadmap, CI policy, and next implementation steps in PLAN_SAST.md

Validation

• just fmt
• just lint

Notes

• Semgrep is intentionally advisory in this first pass so the rules can be tuned before becoming blocking.
• The plan covers the next phases: findings triage, stronger PostgreSQL-specific rules, unsafe/FFI tracking, and a path to selective blocking policies.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.