chore: upload Detekt SARIF to GitHub Security tab once GHAS/public repo available

[ifsantana]

Context

#182 added ktlint + Detekt static analysis to CI, including the intent to upload Detekt's SARIF reports to the GitHub Security tab (github/codeql-action/upload-sarif). That part was dropped from #182's PR because idem-finance/idem is currently a private repo, and GitHub Code Scanning requires GitHub Advanced Security (GHAS) to be enabled for private repos. CI failed with:

Advanced Security must be enabled for this repository to use code scanning.

This is unrelated to workflow permissions — actions: read / security-events: write were already correctly set and didn't help.

What's already in place

detekt-check (bound to the verify phase in root pom.xml) already generates both HTML and SARIF reports per module under <module>/target/detekt.html and <module>/target/detekt.sarif — nothing needs to change there.

What this issue is

Once either:

• the repo is made public (code scanning is free for public repos without GHAS), or
• GHAS is explicitly enabled on this private repo,

re-add the 7 Upload Detekt SARIF (<module>) steps to .github/workflows/ci.yml (removed in #182's PR — see that PR's commit history for the exact step definitions) plus the security-events: write and actions: read permissions. Pure CI-config change, no other rework needed.

Acceptance criteria

• upload-sarif steps re-added to .github/workflows/ci.yml for all 7 modules (core, application, infrastructure, api, mcp, sdk-kotlin, app), each with a distinct category
• permissions: security-events: write and actions: read restored
• CI run on a test PR confirms SARIF results appear in the repo's Security tab