Fix #607, rework static-analysis workflow

[jphickey]

Checklist (Please check before submitting)

• I reviewed the Contributing Guide.
• I signed and emailed the appropriate Contributor License Agreement to [email protected] and copied [email protected].

Describe the contribution
Updates the static analysis workflow:

• Make it work with the latest Ubuntu and Cppcheck
• Allow callers to pass in a project configuration to get "real" macro definitions and include paths
• Streamlined - only generate XML outputs, then use XSLT to convert that to text, rather than running the tool twice.
• Streamlined - merge the two XML outputs into one, before converting to sarif and uploading
• Streamlined - Call the sarif conversion tool directly, rather than going through a 3rd party action.

Fixes #607

Testing performed
Update OSAL static analysis to point to this updated reusable workflow instead of the current one (nasa/cFS main) and check results.

Expected behavior changes
More complete/thorough results, while being a simpler workflow overall

System(s) tested on
Github workflow runner (Ubuntu image)

Additional context
This uses the updated baseline, and the cppcheck tool reports more errors than the old version did. So repos that referred to this workflow in the past may have new errors now.

Contributor Info - All information REQUIRED for consideration of pull request
Joseph Hickey, Vantage Systems, Inc.

[jphickey]

As mentioned in the CCB - this also is (partially) related to #488 in that it is changing the cppcheck workflow at the bundle level to be manual dispatch. After going through how cppcheck operates, I can confirm there is really no value-add from running it at both the bundle and submodule levels, it will report the same info in both places. In other modes of operation, there could be a difference, but not in the way it was invoked in this workflow. In the future, if this changes and it is warranted to do so, the static analysis could be set back to push/pull again, but with the current configuration it doesn't (and will not) show anything different.