Add Checkmarx CxFlow GitHub Action for SAST scanning

[2vz111]

Summary

This PR introduces a GitHub Actions workflow to integrate Checkmarx SAST scanning via CxFlow for the OpenSAMPL repository.

Details

• Added .github/workflows/checkmarx.yml workflow.
• Configured to run on push and pull_request events for the main branch.
• Uses on-prem Checkmarx instance at https://checkmarx.ornl.gov.
• Authentication via built-in resource_owner_client and static client secret.
• Uploads SARIF results to GitHub Security tab for vulnerability visibility.

Notes

• Requires GitHub secrets:
  • CHECKMARX_URL
  • CHECKMARX_USERNAME
  • CHECKMARX_PASSWORD
  • CHECKMARX_CLIENT_SECRET
  • CHECKMARX_TEAMS
• If Checkmarx is not reachable from GitHub-hosted runners, switch to a self-hosted runner inside ORNL network.

Testing

• Workflow will trigger on PR creation and push to main.
• Verify SARIF upload under Security tab and scan results in Checkmarx dashboard.