Add blackduck and codeql scans

[lisajulia]

These scans should be added to pipelines running on main and on PRs to main:

• CodeQL should be run on PRs and main
• Blackduck scan should be run on main in FULL mode (will be persisted on blackduck), then the repo owner will have to manually check the run on blackduck
• Blackduck scan should be run on a PR in RAPID mode with BOM_COMPARE option. then Blackduck will compare that run against the last saved scan and check if new vulnerabilites were added (see https://documentation.blackduck.com/bundle/detect/page/runningdetect/rapidscan.html#rapid-scan-compare-mode)
• In any case: before releasing, the releaser should fix vulnerabilites reported by Blackdock or must make sure they non-critical (e.g. come form SAP dependencies).

[lisajulia]

Replaced by #19