ci: install Semgrep without hash pinning

The hash-pinned requirements-semgrep.txt kept breaking: Semgrep pins its
own dependencies to exact or compatible-release versions, so Dependabot
bumps of any of them (importlib-metadata, exceptiongroup, jsonschema,
peewee, wcmatch, wrapt, ...) made the job fail with ResolutionImpossible.
Install the latest Semgrep with pip instead, remove the lock file and the
Dependabot ignore list that tried to work around it.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/dependabot.yml

@@ -60,11 +60,3 @@ updates:
       interval: daily
     cooldown:
       default-days: 7
-    ignore:
-      # semgrep pins these packages to exact or compatible-release versions (see its METADATA);
-      # bumping them on their own makes the Semgrep job fail with ResolutionImpossible, so
-      # they only move together with a semgrep release
-      - dependency-name: mcp
-      - dependency-name: boltons
-      - dependency-name: "opentelemetry-*"
-      - dependency-name: importlib-metadata

.github/workflows/semgrep.yml

@@ -52,8 +52,12 @@ jobs:
       # the old action fell back to, running community rules with no token.
       # SEMGREP_APP_TOKEN is still passed through so registry auth works if a
       # token is ever added.
+      # Semgrep is deliberately not pinned by hash: its transitive dependencies
+      # are pinned to exact or compatible-release versions, which made the hashed
+      # lock file break on almost every Dependabot bump. The scan only produces
+      # SARIF findings and does not build or ship anything.
       - name: Install Semgrep
-        run: python3 -m pip install --user --require-hashes -r cmake/requirements/requirements-semgrep.txt
+        run: python3 -m pip install --user semgrep
 
       # `semgrep scan --sarif` always exits 0 even with findings; continue-on-error
       # is a safety net so the SARIF upload still runs if the scan itself errors.