* ci(security): add consolidated Semgrep and Psalm taint gate
One workflow runs both taint scanners as separate jobs. Semgrep and Psalm
treat htmle()/html_escape()/sanitize_uri() as sanitizers, so findings mean
request input reaches a browser sink unescaped.
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
* stabilize psalm taint analysis
* Install dependencies before Psalm analysis
* Remove obsolete Psalm taint baseline
---------
Signed-off-by: Thomas Vincent <thomasvincent@gmail.com>
