[INFRA-13215] update security-scan-sast to v2 with Docker Hub auth

[vgs-ci-bot]

Updates the security-scan-sast reusable workflow call:

• Pins to @security-scan-sast-v2 rolling tag (if not already)
• Adds DOCKERHUB_TOKEN secret for authenticated Docker Hub pulls
• Adds SAST_SLACK_WORKFLOW_WEBHOOK secret if missing (required in v2)

This prevents intermittent semgrep failures from stale Docker Hub
credentials and rate limiting on GitHub Actions runners.

See: https://github.com/verygood-ops/cicd-shared/pull/547

[gvisalli-vgs]

Closing — will reopen after fixing semgrep startup_failure (DOCKERHUB_TOKEN must be optional in reusable workflow before callers can pass it)

[gvisalli-vgs]

Closing — switching strategy to pinned tag security-scan-sast-v2.0.13. Teams can opt-in to update their workflow reference when ready. See INFRA-13215.