ci: add CodeQL + SonarQube Cloud security scanning

[jl-0]

Adds workflow-based CodeQL + SonarQube Cloud scanning, following the AMMOS scanning guide and matching the setup on MMGIS and astria_ui. CI configuration only — no application code is touched.

Pipeline

CodeQL → nasa-scrub translate_results → fix_sarif_paths.py → sonarqube-scan-action

nasa-scrub is the step the AMMOS guide prescribes, but it is lossy in two ways that break the SonarQube import:

1. It rewrites CodeQL's workspace-relative URIs to absolute paths and writes the absolute source root into uriBaseId, so SonarQube cannot map findings to files — everything collapses to project-level "unable to resolve issue location".
2. It deletes tool.extensions, where CodeQL keeps its real query metadata, and rebuilds tool.driver.rules as id-only stubs — so every finding imports as MEDIUM regardless of true severity, under a rule key named after the input file rather than CodeQL.

.github/scripts/fix_sarif_paths.py repairs both from the pre-scrub report. It keeps the guide's pipeline intact while making the import correct, and ships with a 24-case unit suite (python3 .github/scripts/test_fix_sarif_paths.py).

Verified end to end

Run 34523549184 is green and its results are on master in SonarQube Cloud. The seven imported findings confirm all three repairs:

	evidence
paths	findings map to real files and line numbers
rule keys	external_CodeQL:*, not external_python:* / external_javascript:*
severities	CRITICAL / MAJOR, not a flat MEDIUM

external_CodeQL:py/path-injection      CRITICAL  ait/gui/__init__.py:990, 1190, 1194
external_CodeQL:py/reflective-xss      CRITICAL  ait/gui/__init__.py:741
external_CodeQL:js/unvalidated-dynamic-method-call  MAJOR  ait/gui/openmct_adapter/ait_integration.js:169
external_CodeQL:js/useless-regexp-character-escape  CRITICAL  ait/gui/static/js/ait/evr.js:131

Those findings are pre-existing and are not addressed here — this PR only turns on the scanning that surfaces them.

Scope

CodeQL analyzes python, javascript-typescript and actions in a single run. Both halves of the application are in scope: ait/gui/__init__.py (the bottle server holding the command, telemetry, sequence, script and file endpoints), ait/gui/static/js (the Mithril front end), and ait/gui/openmct_adapter.

Skipped, with reasons:

path	why
ait/gui/static/build/**	webpack output — the same source as static/js plus its npm deps, so scanning it double-reports every front-end finding and pulls vendored code into LOC
ait/gui/static/css, static/fonts, *.svg, *.png	not code
doc/**	Sphinx pages and a conf.py that is not shipped
tests/**, ait/gui/static/test/**	the Python and mocha suites
**/package-lock.json, **/node_modules/**	covered by Dependabot

.github/ is a Sonar source so CodeQL's actions findings have files to attach to.

Notes for the reviewer

• sonar.branch.name is pinned to master. Leaving it unset does not publish into the project's main analysis — this project is ALM-bound to GitHub, so the scanner auto-detects the branch from the Actions environment and creates a short-lived SonarQube branch (observed on run 34522749731, since deleted). Switch to ${{ github.ref_name }} when per-branch attribution is wanted.
• CodeQL default setup had to be disabled on this repo; advanced configurations cannot upload while it is on. This workflow replaces that coverage with a richer query suite (security-extended) and the shared path exclusions.
• SonarCloud Automatic Analysis had to be disabled for NASA-AMMOS_AIT-GUI; it cannot coexist with CI analysis and cannot import CodeQL SARIF.
• The workflow triggers on push to master and on manual dispatch.

https://claude.ai/code/session_01Bv21RHa8B3VAfPkBLU5M11