Leverage upstream docker image returntocorp/semgrep in CircleCI (#16440)

- Instead of installing semgrep through PyPI on every run, leverage
   the upstream docker image.
 - This should isolate us from dependency updates required to run newer
   versions of semgrep

.circleci/config.yml

@@ -738,20 +738,10 @@ jobs:
     - GO_TAGS: ''
   semgrep:
     docker:
-    - image: docker.mirror.hashicorp.services/alpine:3.13
+    - image: docker.mirror.hashicorp.services/returntocorp/semgrep:0.106.0
     shell: /bin/sh
     working_directory: /home/circleci/go/src/github.com/hashicorp/vault
     steps:
-    - run:
-        command: |
-          apk add --no-cache python3 python3-dev py3-pip make gcc g++
-          python3 -m pip install --user semgrep==0.106.0
-          export PATH="$HOME/.local/bin:$PATH"
-
-          echo "$ semgrep --version"
-          semgrep --version
-        name: Setup Semgrep
-        working_directory: ~/
     - checkout
     - attach_workspace:
         at: .

.circleci/config/commands/setup-semgrep.yml

@@ -1,14 +0,0 @@
----
-description: >
-  Ensure semgrep is installed.
-steps:
-  - run:
-      working_directory: ~/
-      name: Setup Semgrep
-      command: |
-        apk add --no-cache python3 python3-dev py3-pip make gcc g++
-        python3 -m pip install --user semgrep==0.106.0
-        export PATH="$HOME/.local/bin:$PATH"
-
-        echo "$ semgrep --version"
-        semgrep --version

.circleci/config/executors/@executors.yml

@@ -22,9 +22,9 @@ python:
     - image: docker.mirror.hashicorp.services/python:3-alpine
   shell: /usr/bin/env bash -euo pipefail -c
   working_directory: /home/circleci/go/src/github.com/hashicorp/vault
-alpine:
+semgrep:
   docker:
-    - image: docker.mirror.hashicorp.services/alpine:3.13
+    - image: docker.mirror.hashicorp.services/returntocorp/semgrep:0.106.0
   shell: /bin/sh
   working_directory: /home/circleci/go/src/github.com/hashicorp/vault
 docker-env-go-test-remote-docker:

.circleci/config/jobs/semgrep.yml

@@ -1,7 +1,6 @@
 ---
-executor: alpine 
+executor: semgrep
 steps:
-  - setup-semgrep
   - checkout
   - attach_workspace:
       at: .