Changes done to doctype object in `on_submit` are not commited to database. Add rule to catch similar bugs.
Adds semgrep testing in CI. Refer to: - https://github.com/frappe/frappe/pull/12524 - https://github.com/frappe/frappe/pull/12577