Add Security Scan: CodeQL workflow

[KKelvinLo]

Motivation

This PR is a follow-up to issue open-telemetry/oteps#144

CodeQL is GitHub's static analysis engine which scans repos for security vulnerabilities. As the project grows and we near GA it might be useful to have a workflow which checks for security vulnerabilities to ensure that every incremental change is following best development practices. Also passing basic security checks will also make sure that there aren't any glaring issues for our users.

Changes

• This PR adds CodeQL security checks to the repository
• After every run the workflow will upload the results to GitHub.

Current CodeQL run from fork

Workflow Triggers

• daily cron job at 1:30 am
• workflow_dispatch (in the case that the maintainers want to trigger a manual security check)

[pellared]

Thanks for the PR 👍

Can you please add:

1. scanning C++ code
2. hyperlinks from the fork's GitHub Actions to show that it is really working

[KKelvinLo]

Thanks for the PR 👍

Can you please add:

1. scanning C++ code
2. hyperlinks from the fork's GitHub Actions to show that it is really working

I have added the hyperlink to the fork run.

Also I have tried adding the C++ scan, but CodeQL fails to automatically build the C++ code. Similarly in the C++ SDK CodeQL work flow there was a simple setup step where I had to setup the manual dependencies/tools - perhaps you can point me to the manual dependencies / tooling setup for the C++ portion?

[pellared]

I hope this will be helpful:

• opentelemetry-dotnet-instrumentation/.azure-pipelines/unit-tests.yml

  Lines 228 to 242 in d9fd0a7

  	- script: |
  	sudo apt-get update
  	sudo apt-get install -y llvm clang
  	displayName: install_dependencies
  	- script: |
  	cd ./src/Datadog.Trace.ClrProfiler.Native
  	CXX=clang++ CC=clang cmake .
  	make
  	displayName: build_profiler
  	- script: |
  	cd ./src/Datadog.Trace.ClrProfiler.Native
  	CXX=clang++ CC=clang cmake .
  	make

• opentelemetry-dotnet-instrumentation/build/docker/native.dockerfile

  Lines 3 to 14 in fbef233

  	RUN apt-get update && \
  	DEBIAN_FRONTEND=noninteractive apt-get install -y \
  	git \
  	wget \
  	curl \
  	cmake \
  	make \
  	llvm \
  	clang \
  	gcc
  	ENV CXX=clang++
  	ENV CC=clang

[KKelvinLo]

I opened an issue to add C++ code scanning - #178 . To avoid delay, is it possible to approve this pull-request and merge in the C# CodeQL scanning.