Add 12 new Behave BDD scenarios to features/security_scan_hooks.feature
to automatically validate the Semgrep broad exception suppression rules
and their escape hatch behavior, as suggested by reviewer HAL9001.
New scenarios verify:
- python-no-suppressed-exception rule exists and targets src/
- python-no-suppress-exception rule exists and targets src/
- Both rules document the nosemgrep escape hatch in their messages
- Both rules document the error-propagation: allow annotation
- python-no-suppressed-exception has pattern-not for bare re-raise
- python-no-suppressed-exception has pattern-not for exception chaining
- Nox lint session integrates Semgrep and references .semgrep.yml
All 25 scenarios pass (13 original + 12 new).
ISSUES CLOSED: #9103