Enable workflow_dispatch for security scanning across branches

- GitHub Actions workflow with 9 security tools
- Python scripts for reporting and baseline management
- Semgrep custom rules and configuration
- CodeRabbit AI for PR-level security scanning
- Gitleaks ignore patterns for test data

- Add version metadata for upgrade detection
- Fix .dockerignore handling for report container builds
- Use centralized Quay.io repository (security-scans)
- Simplifies permission management

Excludes test fixtures from secret scanning:
- tests/
- testdata/
- sdk/python/tests/
- examples/

Expected impact: Reduces false positives from test data by ~100%
All critical findings (1) are in test fixtures, not production code.

Previous format caused Gitleaks warnings:
  WRN Invalid .gitleaksignore entry

Corrected to glob patterns (one per line):
- tests/
- testdata/
- **/tests/**
- **/testdata/**

This should properly exclude test fixtures from secret scanning.

Added .gitleaks.toml with allowlist for test paths:
- tests/, testdata/, **/tests/**, **/testdata/**
- sdk/python/tests/, examples/

Updated workflow to use config:
- Added --config /repo/.gitleaks.toml to Gitleaks command

Expected impact: Eliminates 1 critical finding (hardcoded key in test fixture)

…est discovery

- GitHub Actions workflow with 9 security tools
- Python scripts for report generation and acknowledgment
- RBAC analyzer for Kubernetes operator privilege escalation detection
- Semgrep custom rules for security patterns
- CodeRabbit AI config for PR-level scanning
- kube-linter config for Kubernetes manifest security
- Gitleaks config to exclude test directories

This installation uses the new v2.3.0 template with intelligent Kubernetes
manifest discovery that will find and scan the feast operator at
infra/feast-operator/ (previously missed by hardcoded paths).

The workflow was failing on GitHub Actions (Linux) because the find
command used the -P flag, which is BSD-specific (macOS only).

GNU find (Linux) doesn't support -P and doesn't follow symlinks by
default anyway, so the flag is unnecessary.

This fixes the workflow failure:
  find: unknown predicate '-P'

Now the intelligent manifest discovery will work on both macOS and
Linux environments.

The previous .gitleaks.toml used glob patterns (**/tests/**) which caused
Gitleaks to crash with regex compile errors.

Gitleaks expects regex patterns, not glob patterns. The new .gitleaksignore
uses proper regex syntax (.*/tests/.*) and will be auto-detected by Gitleaks.

This fixes the Gitleaks crash:
  panic: regexp: Compile(`**/tests/**`): error parsing regexp:
  missing argument to repetition operator: `*`

Changes:
- Remove .gitleaks.toml (glob patterns)
- Add .gitleaksignore (regex patterns)
- Remove --config flag from workflow (auto-detect .gitleaksignore)

The .gitleaksignore template now includes comprehensive test directory
exclusions using proper regex syntax.

- Add .gitleaks.toml with proper path exclusions (not fingerprints)
- Exclude sdk/python/tests/, go/internal/test/, examples/, docs/tutorials/
- Remove .gitleaksignore (expects fingerprints, not suitable for path filtering)

Expected impact: Reduce Gitleaks findings from 1 to 0 (100% of current findings are in test data)