chore: upgrade code scanner to v2

[witmicko]

Description

Updating code scanner to v2

Changelog

CHANGELOG entry:

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

• I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

---

Note

Migrates the security scanning workflow to the v2 reusable action with updated inputs/secrets and broader PR trigger.

• CI (GitHub Actions):
  • Security Scanner Migration: Replace step-based scanner with reusable workflow MetaMask/action-security-code-scanner/.github/workflows/security-scan.yml@v2.
    • Add with inputs: repo, scanner-ref: v2, and paths-ignored (preserves previous ignore list).
    • Map secrets via secrets (project-metrics-token, slack-webhook).
    • Remove explicit runs-on and custom step; rely on reusable workflow.
  • Triggers: Keep push to main; allow pull_request on all branches (removed branch filter); retain workflow_dispatch.
  • Permissions: Keep actions, contents, and security-events permissions.

^{Written by Cursor Bugbot for commit 634c73a. This will update automatically on new commits. Configure here.}

[github-actions]

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud