update from upstream

[kristof-mattei]

• chore(deps): update returntocorp/semgrep docker tag to v1.120.1
• chore(deps): update rust:1.86.0 docker digest to ff735b1
• chore(deps): update rust:1.86.0 docker digest to 13e8910
• chore(deps): update rust:1.86.0 docker digest to 173b003
• chore(deps): update rust:1.86.0 docker digest to f2b92e8
• chore(deps): update rust:1.86.0 docker digest to 640960f
• chore(deps): update github/codeql-action action to v3.28.17
• chore(deps): bump color eyre

[github-actions]

Test results

2 tests  ±0   2 ✅ ±0   0s ⏱️ ±0s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 4ff156e. ± Comparison against base commit 9fd7205.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 11.90%. Comparing base (9fd7205) to head (4ff156e).
Report is 18 commits behind head on main.

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #633   +/-   ##
=======================================
  Coverage   11.90%   11.90%           
=======================================
  Files           3        3           
  Lines          84       84           
=======================================
  Hits           10       10           
  Misses         74       74           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.