ci: install the remaining pip dependencies with --require-hashes (#6050)

Install Semgrep from a new hash-pinned requirements file in
cmake/requirements (covered by Dependabot) instead of a version-only
"pip install semgrep==1.168.0", and pass --require-hashes to the astyle
and natvis installs in check_amalgamation.yml, whose requirements files
got their hashes in #6046. Addresses the Scorecard Pinned-Dependencies
code-scanning alerts for semgrep.yml and check_amalgamation.yml.

Signed-off-by: Niels Lohmann <mail@nlohmann.me>

.github/workflows/check_amalgamation.yml

@@ -67,10 +67,10 @@ jobs:
       - name: Install astyle
         run: |
           python3 -mvenv venv
-          venv/bin/pip3 install -r $MAIN_DIR/tools/astyle/requirements.txt
+          venv/bin/pip3 install --require-hashes -r $MAIN_DIR/tools/astyle/requirements.txt
 
       - name: Install generate_natvis dependencies
-        run: pip3 install -r $NATVIS_TOOL_DIR/requirements.txt
+        run: pip3 install --require-hashes -r $NATVIS_TOOL_DIR/requirements.txt
 
       - name: Regenerate the tools/macro_builder tables in macro_scope.hpp
         run: |

.github/workflows/semgrep.yml

@@ -53,7 +53,7 @@ jobs:
       # SEMGREP_APP_TOKEN is still passed through so registry auth works if a
       # token is ever added.
       - name: Install Semgrep
-        run: python3 -m pip install --user semgrep==1.168.0
+        run: python3 -m pip install --user --require-hashes -r cmake/requirements/requirements-semgrep.txt
 
       # `semgrep scan --sarif` always exits 0 even with findings; continue-on-error
       # is a safety net so the SARIF upload still runs if the scan itself errors.