Code scanning on every push and nightly: secrets, advisories and static analysis, and a new high finding holds a release until a person accepts it #9593

From #9434 box 4.

Done looks like:

• [x] Each push to a repository runs a secret scan and a dependency advisory check; nightly adds static analysis.
• [x] Findings show on the repository and as a line in the flows view.
• [x] A new high finding holds a release; a person with write access accepts it with a reason, which is recorded.
• [x] Tests: a pushed fake secret is found; a high finding holds a release; acceptance lifts it.

Files: src/checks/, src/release/, src/flows/view.ts, test/. Risks: findings never print the secret itself.

Reviewed pull #9599 at its head: ticked Each push to a repository runs a secret scan and a dependency advisory check; nightly adds static analysis.; Findings show on the repository and as a line in the flows view.; A new high finding holds a release; a person with write access accepts it with a reason, which is recorded.; Tests: a pushed fake secret is found; a high finding holds a release; acceptance lifts it..