Replace Semgrep, Trivy, and Gitleaks scripts with one scan gate

When CI runs three scanners with three logs and three exit codes, fold them into one job, one Finding model, and one PASSED/FAILED gate—plus a Semgrep migration checklist.