Add GitHub CodeQL and/or semgrep for static code analysis

[eloquence]

During today's tech meeting we agreed we want to trial run GitHub CodeQL for vulnerability discovery in the SecureDrop Core repository. An example configuration was also merged into the securedrop-export repository: freedomofpress/securedrop-export#64

If we like the quality of its reports after using it for a couple of weeks, we may add it across all SecureDrop-related repos.

[eloquence]

(Removing from board for now, we're continuing to investigate various code analysis options including semgrep.)

[eloquence]

(Closing in favor of the more comprehensive #6111, where we can capture some initial eval notes and prioritize.)