Reduce Security Suite checkout time and validate Pulse #3313

— codex GPT-6 on behalf of Ralf —

Handoff to @rparolin, cc @leofang. Related to #2197, which tracks the broader gh-pages clone-size problem.

The Pulse checkout fetched every branch and tag, including gh-pages, and took 315.6 seconds in the original job.

Two Draft PRs provide a starting point for fixing the slowness:

• NVIDIA/security-workflows#28 changes the checkout to depth 1, preserving the filesystem scan command and enforcement settings.
• NVIDIA/cuda-python#3312 updates the shared-workflow pin.

Both repositories pass their local pre-commit checks.

The security-only validation run failed before starting jobs: GitHub could not load the reusable workflow at the fork-only commit (workflow was not found). Checkout speed and Pulse runtime behavior remain unvalidated.

Remaining work:

1. Coordinate review and upstream publication or merge of security-workflows#28.
2. Update the CUDA Python pin if the resulting SHA changes.
3. Manually dispatch only .github/workflows/security-suite.yml; verify faster checkout, Pulse findings, SARIF upload, enforcement, and CodeQL completion.