fix(ci): pin semgrep version, add pip cache, harden rule severity

- Pin semgrep to 1.163.0 to prevent silent upgrades breaking the scan
- Add cache: 'pip' to setup-python@v5 for faster CI runs
- Promote all three XXE Semgrep rules from WARNING to ERROR to match
  the --error CI flag intent
- Update SAX/StAX rule messages to reference XxeSafeXmlParser and
  the OWASP XXE prevention cheat sheet
- Remove stale issue reference from regression test comment
- Document XML metacharacter constraint on buildValidOds test helper

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/test/java/org/raddatz/familienarchiv/importing/MassImportServiceTest.java

@@ -527,7 +527,7 @@ class MassImportServiceTest {
 
     // ─── readOds — XXE security regression ───────────────────────────────────
 
-    // Security regression — do not remove. Introduced by issue #528.
+    // Security regression — do not remove.
     @Test
     void readOds_rejects_xxe_doctype_payload(@TempDir Path tempDir) throws Exception {
         File malicious = buildXxeOds(tempDir, "file:///etc/hostname");
@@ -595,7 +595,8 @@ class MassImportServiceTest {
         return writeOdsZip(dir.resolve("malicious.ods"), xml);
     }
 
-    /** Creates a minimal valid ODS ZIP containing a content.xml with the given cell value. */
+    /** Creates a minimal valid ODS ZIP containing a content.xml with the given cell value.
+     *  cellValue must not contain XML metacharacters ({@code < > &}). */
     private File buildValidOds(Path dir, String cellValue) throws Exception {
         String xml = "<?xml version=\"1.0\"?>"
                 + "<office:document-content"