Consider adding LGTM code analysis to CI

[emkll]

Description

LGTM offers static code analysis, including security vulnerabilities. It auto-detects languages (and as a result checks the (very little) JavaScript in the repo.

There are a couple of interesting findings that were missed by flake8 (non security-related) :
https://lgtm.com/projects/g/freedomofpress/securedrop/

An admin can add the integration using the marketplace, as is free for open source projects: https://github.com/marketplace/lgtm

User Stories

As a developer, I want to ensure my code is scanned for vulnerabilities and errors.

[conorsch]

Added the integration to the securedrop repository. Haven't configured any additional checks, so there will likely be follow-up actions required. A GitHub org admin will be required for coordination there. Please list any additional steps required here, or we can coordinate in standup.

[redshiftzero]

thanks! this is now running on PRs, so closing: #4879 (comment)