* feat(sandbox): replace Semgrep with Opengrep and bundle offline rules
* fix(sandbox): keep opengrep-rules LICENSE and drop proprietary-licensed rules
* feat(sandbox): add Strix rule for GitHub-owned actions not pinned to a commit SHA
* chore: bump sandbox image to 1.4.0 (opengrep)
* fix(sandbox): resolve the gitleaks release tag without the GitHub API
* fix(sandbox): install a pinned, sha256-verified trivy release
