Replace Semgrep, Trivy, and Gitleaks scripts with one scan gate

The merge request is green, then release is blocked by a secret or dependency CVE—usually because...