ci: add security scanning workflow templates
Templates for repos to enable language-specific security scanning:
- security-php.yml: PHPStan + Semgrep SAST
- security-shell.yml: ShellCheck for bash scripts
- security-docker.yml: Hadolint for Dockerfiles
CodeQL default setup now enabled across all public repos for:
- Go, JavaScript/TypeScript (core, core-gui, build)
- JavaScript/TypeScript (core-admin, core-api, core-mcp, etc.)
- Actions workflow scanning (core-php, core-tenant, etc.)
- Python (ansible-*, docker-server-blockchain)
- C# (btcpayserver-docker)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
d6d4ddb15b