Add Socket Basics security scanning

[grantcox]

Adds Socket Basics (SAST) scanning to this repo, calling the shared ynab-sast-scanner workflow — the same setup already in place across other YNAB repos.

.github/workflows/socket-basics.yml:

• uses: ynab/ynab-sast-scanner/.github/workflows/socket-basics.yml@main
• SOCKET_SECURITY_API_KEY and SAST_SUPPRESSIONS_APP_PRIVATE_KEY secrets (both org-level, nothing per-repo needed)

[github-actions]

Socket SAST-GENERIC

Summary

🔴 Critical: 8 | 🟠 High: 0 | 🟡 Medium: 0 | ⚪ Low: 0

Details

spec/recurly_v2/adjustment_spec.rb (🔴 Critical: 2)

🔴 ruby-unsafe-deserialization: CRITICAL

spec/recurly_v2/adjustment_spec.rb:118

        adjustment_from_dump = Marshal.load(Marshal.dump(adjustment))

spec/recurly_v2/adjustment_spec.rb:127

        adjustment_from_dump = Marshal.load(Marshal.dump(adjustment))

spec/recurly_v2/billing_info_spec.rb (🔴 Critical: 2)

🔴 ruby-unsafe-deserialization: CRITICAL

spec/recurly_v2/billing_info_spec.rb:230

      billing_info_from_dump = Marshal.load(Marshal.dump(billing_info))

spec/recurly_v2/billing_info_spec.rb:240

      billing_info_from_dump = Marshal.load(Marshal.dump(billing_info))

spec/recurly_v2/credit_payment_spec.rb (🔴 Critical: 2)

🔴 ruby-unsafe-deserialization: CRITICAL

spec/recurly_v2/credit_payment_spec.rb:36

      credit_payment_from_dump = Marshal.load(Marshal.dump(credit_payment))

spec/recurly_v2/credit_payment_spec.rb:44

      credit_payment_from_dump = Marshal.load(Marshal.dump(credit_payment))

spec/recurly_v2/transaction_spec.rb (🔴 Critical: 2)

🔴 ruby-unsafe-deserialization: CRITICAL

spec/recurly_v2/transaction_spec.rb:63

      transaction_from_dump = Marshal.load(Marshal.dump(transaction))

spec/recurly_v2/transaction_spec.rb:71

      transaction_from_dump = Marshal.load(Marshal.dump(transaction))

[grantcox]

Superseded by #4 — this branch name contained a stray zero-width space (U+200B), which is what triggered GitHub's hidden-character warning. Recreated from a cleanly named branch.