[1/2] Add Security workflows: CodeQL scan workflow

[amanbrar1999]

Motivation

Follow up to issue open-telemetry/oteps#144

CodeQL is GitHub's static analysis engine which scans repos for security vulnerabilities. As the project grows and we near GA it might be useful to have a workflow which checks for security vulnerabilities with every PR so we can ensure every incremental change is following best development practices. Also passing basic security checks will also make sure that there aren't any glaring issues for our users.

Changes

• This PR adds CodeQL security checks to the repo
• After every run the workflow uploads the results to GitHub. Details on the run and security alerts will show up in the security tab of this repo.

Workflow Triggers

• daily cron job at 1:30am
• workflow_dispatch (in case maintainers want to trigger a security check manually)

cc- @alolita

[codecov]

Codecov Report

Merging #1922 (3280509) into master (c7d7acd) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master    #1922   +/-   ##
=======================================
  Coverage   89.95%   89.95%           
=======================================
  Files         381      381           
  Lines       18519    18519           
=======================================
  Hits        16659    16659           
  Misses       1390     1390           
  Partials      470      470           

Flag	Coverage Δ
integration	69.82% <ø> (ø)
unit	88.67% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c7d7acd...3280509. Read the comment docs.