need to pin go-semgrep linter

We need to pin go-semgrep linter, and keep it up to date via renovate bot.

(follow-up to sylva-projects/sylva-elements/sylvactl!357 (comment 2703615565))