Authenticate semgrep container pull with caller's Docker Hub credentials

[ulziibay-kernel]

Summary

The Semgrep reusable workflow's job container pulls semgrep/semgrep from Docker Hub anonymously. Hosted runner IPs share Docker Hub's anonymous pull rate limit, so callers' Semgrep runs have been failing at "Initialize containers" with Docker Hub errors (seen in kernel/kernel and kernel/infra today).

Add a credentials: block to the container using vars.DOCKERHUB_USERNAME / secrets.DOCKERHUB_TOKEN. In a reusable workflow, vars and inherited secrets resolve from the calling repository, so each caller's own Docker Hub credentials are used. Callers that pass secrets: inherit and have these configured get authenticated pulls; callers without them fall back to today's anonymous pull (the runner skips login when the values are empty).

Callers using this workflow at @main (kernel/kernel, kernel/infra, and others) pick this up on their next PR run once merged — no caller-side change needed.

Testing

This PR's own CI exercises the change. Did not run anything locally (workflow-only change).

---

Note

Low Risk
Workflow-only change with optional credentials and no application or security-logic changes; misconfigured secrets would only affect container pull, not code execution paths.

Overview
Fixes Semgrep reusable workflow failures at container initialization caused by Docker Hub anonymous pull rate limits on shared GitHub runner IPs.

The scan job’s semgrep/semgrep container now includes a credentials block wired to the calling repo’s vars.DOCKERHUB_USERNAME and secrets.DOCKERHUB_TOKEN (with secrets: inherit). Repos that configure those get authenticated pulls; if they’re unset, behavior stays the same as before with an anonymous pull.

^{Reviewed by Cursor Bugbot for commit a80699d. Bugbot is set up for automated code reviews on this repo. Configure here.}