We are not pedantic enough to pin Actions versions to a SHA. Re-enable semgrep scans on previously-ignored .github/workflows and disable yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag