Extract sast upload scan to standalone workflow

[jamesobrooks]

Purpose

The upload and scan job occasionally breaks builds on main because only one such scan may be in progress at a time. We need to not run on every merge to main.

Major Changes

• Adds a new scheduled workflow (Mondays at 6 a.m. UTC) with the option to trigger manually.
• Removes the upload and scan from the continuous deployment workflow.

Testing/Validation

Workflow dispatch triggers cannot be run until after merge to main, so validation will be performed after the merge.

[jamesobrooks]

Successful manually-triggered GitHub Actions Workflow run - https://github.com/US-Trustee-Program/Bankruptcy-Oversight-Support-Systems/actions/runs/10706588570.