Add taint-based Davidson Semgrep rules

modules/security.sh

@@ -63,6 +63,7 @@ echo "→ Semgrep"
 
 if semgrep scan \
     --config=p/security-audit \
+    --config=.davidson-ci/semgrep/davidson.yml \
     --error \
     --exclude=node_modules \
     --exclude=vendor \