Enable static analysis

Static analysis enables us to find (some) dangerous programming patterns. After a POC with CodeQL against Cucumber-Ruby and Cucumber-JVM we surfaced some interesting findings. So it is worth rolling out this to more projects seems worth while.

Unfortunately, enabling CodeQL in the Cucumber Ecosystem isn't trivial. With a relatively slow build process, frequent renovate updates and limited runners using the default settings results in CI getting swamped. So we should take care to:

1. The CodeQL scan should run against relevant changes only.
2. Each language has it's own CodeQL workflow.

Enable for:

- [x] C/C++
- [ ] Cucumber-CPP
- [x] C#
- [x] GitHub Actions
- [x] Go
- [ ] Godog - https://github.com/cucumber/godog/pull/739
- [x] Java
- [ ] Cucumber eclipse
- [x] Javascript + Typescript
- [x] Python
- [x] Ruby
- [x] Aruba https://github.com/cucumber/aruba/pull/1007
- [x] cucumber/action-* repos