pantsbuild/pants release_2.24.0.dev3

on GitHub

Upgrade semgrep 1.86 -> 1.94 (#21595)

Align 2.23's release notes on main to those on 2.23.x branch (#21596)

Ensure deterministic jvm lockfiles (#21561)

Run ruff as an external tool, not via Python/PEX (#21237)

Deprecate running on macOS 12 (and 13, for arm64) (#21569)

mypy: lint scripts without extensions (#21575)

Document missing binary as common issue (#21459)

golang: support all: prefix for go:embed directives (#21559)