OpenSSF: enable Static Application Security Testing (SAST)

[kgiusti]

The OpenSSF scorecard tool recommends using SAST. Specifically it recommends that Github based project enable Github code scanning.

Refer: https://github.com/ossf/scorecard/blob/main/docs/checks.md#sast