Add SemGrep and exclusion tests

[Luc45]

This PR:

• Updates the QIT Self Tests to account for SemGrep.
• Adds a self-test for Security tests that assert that:
  • Exclude patterns can be set globally to be ignored by PHPCS
  • Exclude patterns can be set per-rule on PHPCS (Eg: MailPoet could exclude EscapeOutput rule on generated/twig directory).

[zhongruige]

This is great, thanks for getting this in @Luc45! A quick follow up we'll want to try and do is add some documentation to the public docs around the changes added here, but it doesn't need to hold up this PR.