feat: static analysis plumbing for BHCE

[superlinkx]

Description

• Adds a new static analysis pipeline to GitHub Actions to enforce our static analysis rules going forward
• Resets the static analysis config to sane defaults. This includes moving some ignored rules to warnings so they can eventually be tackled.
• Adds just analyze command using St Bernard. The results are filtered and prettified by jq for better local dev ergonomics (you can click the links to go directly to the line)
• Includes fixes for triggered error rules

Motivation and Context

No broken windows

How Has This Been Tested?

• Local runs of the analyzer match expectations and complete as expected
• Pipeline tested several times to ensure consistent results

Types of changes

• Chore (a change that does not modify the application functionality)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• Documentation updates are needed, and have been made accordingly.
• I have added and/or updated tests to cover my changes.
• All new and existing tests passed.
• My changes include a database migration.

[zinic]

👍