Run the same semgrep rules in the pre-push hook and CI

Pre-push hook now runs the same semgrep rules as CI, blocking new findings instead of old ones.