chore: update security scanning workflows

[haribabug]

Security Scanning Workflows — Update

This PR syncs the security scanning configuration with the latest version from
ROCm/rocm-repo-template.

The original "chore: add security scanning workflows" PR for this repository has already been merged;
this follow-up brings the following file(s) back in line with the template:

• .github/workflows/pr-security-scan.yml
• .github/workflows/weekly-security-scan.yml
• .github/dependabot.yml
• .github/scan_tools_configs/bandit.yml
• .github/scan_tools_configs/gitleaks.toml
• .github/scan_tools_configs/trivy.yml
• .github/scan_tools_configs/zizmor.yml

Why

The template evolved after the initial rollout. This keeps this repository aligned
with the ROCm GitHub Organization Security Baseline.

---

For more details, refer ROCm GitHub Org Security Controls Baseline Architecture

Support/Questions: Teams Channel ROCm Security Discussions

[github-actions]

Security scan found no critical or high findings on lines changed by this pull request (coverage incomplete)

Coverage was incomplete:

• Security scan / Security scanners concluded with failure.

View the security scan run for complete reports.

“New” means the finding is located in a changed file on an added or modified line; it is not a base-versus-head findings delta.

[mch]

@haribabug can you comment on why the trivy and zizmor scans are failing?

[mch]

Shouldn't we keep this updater? It's what's going to address the trivy findings. Keep it together with the labels that were also deleted below.

[mch]

I think the CodeQL config that is already in this repo should be removed in favour of the baseline, and the findings that are causing failures should be addressed before merging this.

[mch]

The baseline called here brings its own CodeQL with it: security-baseline.yml@228e623 contains a codeql: job that calls ROCm/rocm-security-gh/.github/workflows/codeql.yml, which runs codeql-action/analyze with category: "/language:${{ matrix.language }}". With scan_mode: all on this workflow that resolves to /language:c-cpp, which is exactly the category the existing .github/workflows/codeql.yml in this repo uploads for the same ref. Two analyses publishing the same category against the same ref replace one another, so alerts are likely to flap depending on which run finished last, and the baseline's build-mode: none extraction sees a different amount of C/C++ than the current manual cmake/make build does. That existing workflow is also the source of 4 of the 13 HIGH zizmor findings in this PR's own run (unpinned actions/checkout@v4, github/codeql-action/*@v3, and the unpinned rocm/dev-ubuntu-22.04:latest container).

I think it would be better to drop .github/workflows/codeql.yml as part of this PR and let the baseline own CodeQL, after confirming build-mode: none gives comparable C/C++ coverage and passing codeql_config_path if any scoping from the old workflow needs preserving.

[mch]

Accidently approved