chore(scan): integrate KICS scanning into PR pipelines

[brandtkeller]

Description

Integration of kics static analysis for IaC (kubernetes)

Decided to ignore files explicitly as opposed to a configuration file. I don't hold a strong opinion here but I didn't want to potentially flag entire directories for which we may want some insights. There is an argument for blanket ignoring the whole of test/demo directories and still scanning src.

Related Issue

Resolves #750

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Checklist before merging

• Test, docs, adr added or updated as needed
• Schema Updates applied
• Contributor Guide Steps followed

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[mildwonkey]

I'm good with this as it is, though I'd like to suggest for the future that we move our test directory layout to something more idiomatic - all extra test data files in a directory called testdata (nested in a directory under testdata works too) and exclude that pattern.