Add CodeQL variant analysis scanning

[dfarrell07]

This is a different type of static analysis than others we run.

It identified new issues (already fixed) that our other tool missed.

The company that built it was bought by GitHub and the tool is being
integrated into GitHub's security workflow.

Add one unprivileged version of the job to gate PRs and one privileged
version on-merge to report results.

Relates-to: submariner-io/submariner#1970
Signed-off-by: Daniel Farrell dfarrell@redhat.com

[submariner-bot]

🤖 Created branch: z_pr2212/dfarrell07/codeql2
🚀 Full E2E won't run until the "ready-to-test" label is applied. I will add it automatically once the PR has 2 approvals, or you can add it manually.

[dfarrell07]

2022-08-26T15:04:36.5162383Z ##[warning]This run of the CodeQL Action does not have permission to access Code Scanning API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the Action has the 'security-events: write' permission. Details: HttpError: Resource not accessible by integration

I think this is not an issue, missing these experimental features on PR scans, but wanted to highlight.

[submariner-bot]

🤖 Closed branches: [z_pr2212/dfarrell07/codeql2]

[dfarrell07]

Little late, but FYI you can see this correctly failing here: dfarrell07/submariner-website#6 / https://github.com/dfarrell07/submariner-website/pull/6/checks?check_run_id=8039932528 (all the bugs in found by CodeQL Go have already been fixed)