Fix wildcard detection (#11), dead repo URLs, and duplicate CI steps

[Dishanth234]

Summary

Detectors: colon-syntax prefix wildcards (Bash(cmd:*) — the form Claude
Code writes for "always allow") now classify the same as the equivalent space
form (Bash(cmd *)), and bare tool-wide wildcards such as Bash(*) are
flagged OVERBROAD instead of safe. Bash(*) reuses the existing OVERBROAD
category rather than adding a new severity tier — happy to adjust if you'd
prefer it ranked higher. Two detector tests added.

Docs/UI: dead VantaInc/grantguard links (404 since the org rename) now
point to OpenVanta/GrantGuard — the CONTRIBUTING clone command, the
changelog link references, the issue chooser's security-advisory link, and
both spots in the web UI share modal. Also points the oxfmt link at its live
docs page. This revives the approved-but-unmerged #10 (credit to
@imran-siddique).

CI: removes the duplicated setup-python v6.3.0 / checkout v7.0.0
steps left behind by a merge conflict resolution, so each job checks out and
sets up Python exactly once. Also obsoletes the dependabot re-bump in #28.

Verified: 90/90 tests on Python 3.10 and 3.12, compileall clean,
pnpm fmt:check passes, no new pnpm check errors, every replacement URL
returns 200.

Related issue

Closes #11

Type of change

• Bug fix
• New risk detector / detection improvement
• New feature
• Docs / chore

Checklist

• uv run python -m compileall -q grantguard grantguard.py passes
• No new runtime dependencies (stdlib only)
• New secret-matching patterns are also covered by redact() (n/a — no new secret patterns; the added detectors are non-redacting)
• Docs updated if behavior changed (CHANGELOG)
• I verified the change manually (CLI and/or UI)

[Dishanth234]

Hi @hermanerr, @chriskrycho first-time contributor here. This bundles the
fix for #11 with the dead-URL fixes previously approved in #10 and a CI
step de-dup. When you get a moment, could you approve the workflow run so
the required checks can report? Happy to split this into separate PRs or
adjust the Bash(*) severity if you'd prefer.