ci: upload analyzer results as SARIF

[gastmaier]

Use native SARIF output from the GCC and Clang analyzers. Merge translation-unit reports and upload them to GitHub code scanning.

PR Description

• Please replace this comment with a summary of your changes, and add any context
  necessary to understand them. List any dependencies required for this change.
• To check the checkboxes below, insert a 'x' between square brackets (without
  any space), or simply check them after publishing the PR.
• If you changes include a breaking change, please specify dependent PRs in the
  description and try to push all related PRs simultaneously.

PR Type

• Bug fix (a change that fixes an issue)
• New feature (a change that adds new functionality)
• Breaking change (a change that affects other repos or cause CIs to fail)

PR Checklist

• I have conducted a self-review of my own code changes
• I have compiled my changes, including the documentation
• I have tested the changes on the relevant hardware
• I have updated the documentation outside this repo accordingly
• I have provided links for the relevant upstream lore