Security scanning with CodeQL and Grype

[apetkau]

Description of changes

Sets up code scanning using GitHub actions. In particular, two methods for code scanning are provided:

• CodeQL: This scans both the Java and JavaScript code for potential vulnerabilities or security issues in our code.
• Anchor Security Scan: This builds the IRIDA WAR package and scans for vulnerable Java dependencies using the Grype security tool.

Both of these tools compile results into a SARIF file format, which can be integrated with GitHub. In particular, results of code scanning will show up in the Checks tab of a pull request, as well as the Security tab of the repository.

Code scanning results for a particular Pull request are available to view for anyone who has read permission to the repository. A summary of all results provided in the Security tab are only available for those with write permissions to the repository. See Managing code scanning alerts for your repository for more details.

You can configure security levels that cause pull-request failures in the Security section of the Repository Settings (I have it currently set to only failure for Critical security alerts).

Related issue

Implements #1335

Checklist

Things for the developer to confirm they've done before the PR should be accepted:

• CHANGELOG.md (and UPGRADING.md if necessary) updated with information for new change.
• Tests added (or description of how to test) for any new features.
• [ ] User documentation updated for UI or technical changes.

[ericenns]

👍 Thanks for adding this @apetkau