chore(workflow): update semgrep.yml

Update the semgrep workflow to always use the "ubuntu-latest" release
and on the "trunk" branch.

.github/workflows/semgrep.yml

@@ -1,18 +1,16 @@
-
 on:
   pull_request: {}
   workflow_dispatch: {}
-  push: 
+  push:
     branches:
-      - main
-      - master
+      - trunk
   schedule:
-    - cron: '0 0 * * *'
+    - cron: "0 0 * * *"
 name: Semgrep config
 jobs:
   semgrep:
     name: semgrep/ci
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     env:
       SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
       SEMGREP_URL: https://cloudflare.semgrep.dev
@@ -21,5 +19,5 @@ jobs:
     container:
       image: returntocorp/semgrep
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: semgrep ci