Extend the advisor with Static Application Security Testing (SAST)

[sschuberth]

We could extend the advisor's capabilities for static code analysis, esp. with a focus on security, like with any of these (alphabetical order):

• Bearer
• Eclipse Steady.
• Semgrep

See e.g. here for an overview.

[tsteenbe]

@sschuberth Note that Bearer is under Elastic License 2.0 which does not allow providing Bearer CLI to third parties as a hosted or managed service. Will be an issue for several ORT users such as Bosch.

[sschuberth]

To start with, we should probably do like GitLab does and use Semgrep for pretty much everything.