test: Improvements to CI Workflows

[evansims]

Changes

This pull request updates our continuous integration workflows. It (in part) mirrors improvements made to the Lock repository.

codeql.yml

• Updated pull_request type triggers to use a narrower scope (avoids unnecessary runs) and apply to all branches.
• Updated push branch triggers to be more concise (uses the v* wildcard.)
• Added concurrency check (cancels redundant in-progress runs.)
• Updated to skip unnecessary runs on Dependabot PRs and re-runs on merge group queues.

publish.yml

• Fixed the NODE_VERSION environmental variable reference.

semgrep.yml

• Updated to skip unnecessary runs on Dependabot PRs and re-runs on merge group queues.
• Updated name to use "Check for Vulnerabilities" for clarity in branch protection filters.
• Added concurrency check (cancels redundant in-progress runs.)

snyk.yml

• Added workflow to trigger Snyk security checks.
  We previously used webhooks to trigger these checks, but this method is incompatible with GitHub's merge queue feature. This approach allows us to use the feature, as well as to autonomously run checks on a set schedule as we do in other repositories.

test.yml

• Moves the Codecov coverage upload step into the unit test step (fixes coverage not being available during the build step.)

References

Updates based on internal feedback and conversations.

Testing

This pull request applies improvements to the continuous integration testing for the repository but does not add additional tests.

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All code quality tools/guidelines have been run/followed