Add brakeman scan

I also moved the .setup-langs:script to before_script.

This is just a bit more convenient because it's used as a before much more frequently