Enable static analysis #2309

Static analysis enables us to find (some) dangerous programming patterns. After a POC with CodeQL against Cucumber-Ruby and Cucumber-JVM we surfaced some interesting findings. So it is worth rolling out this to more projects seems worth while.

Unfortunately, enabling CodeQL in the Cucumber Ecosystem isn't trivial. With a relatively slow build process, frequent renovate updates and limited runners using the default settings results in CI getting swamped. So we should take care to:

1. The CodeQL scan should run against relevant changes only.
2. Each language has it's own CodeQL workflow.

Enable for:

• C/C++
  • Cucumber-CPP
• C#
• GitHub Actions
• Go
  • Godog - Enable CodeQL for Go godog#739
• Java
  • Cucumber eclipse
• Javascript + Typescript
• Python
• Ruby
  • Aruba Enable CodeQL aruba#1007
• cucumber/action-* repos