Add GitHub code scanning alerts as source for the security warnings metric

[fniessink]

Docs: https://docs.github.com/en/rest/reference/code-scanning

Note: GitHub uses the Sarif format. Sarif Python Object Model: https://github.com/microsoft/sarif-python-om

Also see this PyGitHub PR: https://github.com/PyGithub/PyGithub/pull/2063

[JoostVoskuil]

Hi @fniessink I see you are looking for an use case. I have one ;) A couple of months ago I developed an extension for Azure DevOps called Gitleaks to scan for secrets in git repositories in Azure DevOps. It would be great if quality time also supports imports for SARIF.

[fniessink]

@JoostVoskuil Nice. Are you actually using Quality-time?

[JoostVoskuil]

It's on my roadmap 2022 for VWS :)

[fniessink]

Sounds interesting. Let us know if/when you need support and how we can help!