Run semgrep in one batch

Enforces semgrep serial mode to prevent parallel batch scans from interleaving checkout state and producing inconsistent findings.