Add fail-closed Semgrep analyzer

[haasonsaas]

Summary

• add a Linux room-semgrep provider that runs OSS semgrep-core against confined source snapshots
• bind analyzer receipts to the submitted diff, rules config, scanned targets, and explicit Room signal metadata
• add an initial Go dynamic-SQL taint rule and document provider setup

Test plan

• go test ./...
• validate analyzers/semgrep/room.yml with Semgrep CE 1.139
• run real-core smoke tests for an added-line taint finding, a deletion-only diff, and a finding marked nosem