Actions: exclude mutable action tag rule from Semgrep scans (#11944)

We are not pedantic enough to pin Actions versions to a SHA.
Re-enable semgrep scans on previously-ignored .github/workflows and disable
yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag

.github/workflows/sec_sast_semgrep_cron.yml

@@ -29,7 +29,8 @@ jobs:
           semgrep \
             --sarif --output report.sarif \
             --metrics=off \
-            --config="p/default"
+            --config="p/default" \
+            --exclude-rule="yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"
 
       # step 3
       - name: save report as pipeline artifact

.github/workflows/sec_sast_semgrep_pull.yml

@@ -28,4 +28,5 @@ jobs:
             --error \
             --metrics=off \
             --baseline-commit ${{ github.event.pull_request.base.sha }} \
-            --config="p/default"
+            --config="p/default" \
+            --exclude-rule="yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag"