Expand Semgrep coverage and integration tests

[haasonsaas]

Summary

• add defensible Go/Rust rules for secret literals, untrusted outbound destinations, and Rust command arguments
• broaden standard-library input and SQL sink coverage while documenting the exact supported families
• run real semgrep-core 1.139.0 integration tests in CI, including positive, negative, diff-filtering, invalid-rule, and fail-closed cases

Test plan

• go test -count=1 ./...
• ROOM_SEMGREP_CORE=/home/developer/.local/bin/semgrep-core go test -count=1 -tags=semgrep_integration ./cmd/room-semgrep
• semgrep scan --oss-only --metrics off --disable-version-check --strict --validate --config analyzers/semgrep/room.yml
• actionlint .github/workflows/ci.yml