fix: correct tfsec and grype SARIF output in CI workflows

[supernovae]

• tfsec: use format: sarif + additional_args: --out instead of invalid sarif_file input, add github_token to prevent API rate limiting
• grype: upgrade anchore/scan-action from v4 to v7 which adds output-file for reliable SARIF path and uses Node 24 (resolves Node.js 20 deprecation warning)
• Apply same fixes to both security.yml and release.yml

Made-with: Cursor

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.