sdk%lint: add git filter helper script, introduce new semgrep rules, port secret-holding Debug restriction, unknown value preservation rule from CodeQL - #15